{"id":3472,"date":"2011-10-28T20:37:49","date_gmt":"2011-10-29T03:37:49","guid":{"rendered":"http:\/\/blog.intego.com\/?p=3472"},"modified":"2024-04-18T03:26:21","modified_gmt":"2024-04-18T10:26:21","slug":"new-malware-devilrobber-grabs-files-and-bitcoins-performs-bitcoin-mining-and-more","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/new-malware-devilrobber-grabs-files-and-bitcoins-performs-bitcoin-mining-and-more\/","title":{"rendered":"New Malware DevilRobber Grabs Files and Bitcoins, Performs Bitcoin Mining, and More"},"content":{"rendered":"

Intego has discovered a new malware called DevilRobber.A. This malware, which has been found in several applications distributed via BitTorrent trackers, steals data and Bitcoin virtual money, and uses CPU and GPU time on infected Macs to perform “Bitcoin mining.”<\/p>\n

This malware is complex, and performs many operations. It is a combination of several types of malware: it is a Trojan horse, since it is hidden inside other applications; it is a backdoor, as it opens ports and can accept commands from command and control servers; it is a stealer, as it steals data and Bitcoin virtual money; and it is a spyware, as it sends personal data to remote servers.<\/p>\n

DevilRobber has been found in a small number of Mac applications that are distributed via BitTorrent trackers, including a popular graphic program.<\/p>\n


\n\"\"<\/a><\/center>When the doctored application is launched, a preflight script looks for Little Snitch, a network traffic blocker; if Little Snitch is found, the program terminates. If not, the malware adds a LaunchAgent file in the user’s ~\/Library\/LaunchAgents folder, to ensure that the malware launches on each reboot or login. The malware then searches for specific types of files with Spotlight, and writes data in a text file. It saves the user’s bash history file (this is a history of commands run in the Terminal application), saves the user’s Safari history file, takes a screenshot and saves that, and, if the user has a Bitcoin wallet, saves that as well. Another variant Intego has discovered also saves the user’s keychain files.<\/p>\n

DevilRobber then launches a proxy on port 34522, and waits for a user to enter their user name and password; if this happens, it records these credentials, and sends them to a remote server. The malware continues performing other operations, such as posting data to a remote server, looking for the infected Mac’s external IP address, scanning the local network the Mac is on, searching for child pornography, and more.<\/p>\n

One of the main tasks of this malware is to perform “Bitcoin mining.” This procedure is a way of defrauding the Bitcoin virtual money service by making calculations and generating Bitcoins. (Learn more about how to protect your Mac from unwanted Bitcoin mining<\/a>.)<\/p>\n