{"id":35936,"date":"2020-07-07T19:39:00","date_gmt":"2020-07-07T19:39:00","guid":{"rendered":"http:\/\/b4d62013-953b-4a32-a4cd-b60a04c2b9f1"},"modified":"2020-07-07T19:39:00","modified_gmt":"2020-07-07T19:39:00","slug":"free-decryptor-available-for-thiefquest-ransomware-victims","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/free-decryptor-available-for-thiefquest-ransomware-victims\/","title":{"rendered":"Free decryptor available for ThiefQuest ransomware victims"},"content":{"rendered":"
\"evilquest-popup.png\"<\/span>
<\/span> Image: Dinesh Devadoss <\/span><\/figcaption><\/figure>\n

Cyber-security firm SentinelOne has released today a free decryptor app that can help victims of the TiefQuest ransomware recover their locked files.<\/p>\n

The ThiefQuest ransomware — initially identified under the name of EvilQuest — targets only Mac users.<\/p>\n

ThiefQuest’s classification as a ransomware strain is tenuous. The malware is a smorgasbord of malicious code that includes modules for logging keystrokes, installing a reverse shell for backdoor access to infected hosts, code for stealing cryptocurrency-related data, and encrypting files (the so-called ransomware part).<\/p>\n

Security researchers have seen the malware distributed in the wild for more than a month, usually hidden inside pirated software shared on torrent portals and online forums.<\/p>\n

ThiefQuest contains a faulty ransomware component<\/h3>\n

Based on previous analysis [1<\/a>, 2<\/a>, 3<\/a>], the malware is considered to be in its early stages of development, and, as a result, some of its components don’t seem to function correctly.<\/p>\n

Unfortunately for victims, the ransomware part is one of those faulty components and appears to contain many unpolished features.<\/p>\n

Researchers say that while ThiefQuest encrypts files as soon as it infects a macOS system, the malware does not come with a mechanism for tracking users who paid the ransom demand, nor does it provide a contact method so users can contact the ThiefQuest team with details about their payment and receive instructions on how they could unlock their files — a detail that is obvious from reading its ransom note below.<\/p>\n

\"evilquest-ransom-note.png\"<\/span>