attempt to detect KERANGER RANSOMWARE from Transmission - Mac - superseded
| 0 Votes |
Versioning - This is an older version.
| 1 | attempt to detect KERANGER RANSOMWARE from Transmission - Mac | 3/7/2016 12:30:54 PM |
| 2 | attempt to detect KERANGER RANSOMWARE from Transmission - Mac | 3/7/2016 12:53:39 PM |
| 3 | attempt to detect KERANGER RANSOMWARE from Transmission - Mac | 3/7/2016 1:42:38 PM |
Description
This analysis attempts to detect signs of the KERANGER RANSOMWARE that was installed along with Transmission v2.90
Related:
- https://macmule.com/2016/03/07/keranger-ransomware-an-attempt-at-detection-removal-via-the-jss/
- //twitter.com/nixcraft/status/706535801497096192
Property Details
| 2995857 | |
| Alpha - Code that was just developed | |
| attempt to detect KERANGER RANSOMWARE from Transmission - Mac | |
| BESC | |
| jgstew on 3/7/2016 12:30:54 PM | |
| jgstew on 3/7/2016 12:30:54 PM | |
| 4281 Views / 74 Downloads | |
* Average over 0 ratings.
** Log In or Register to add your rating.
|
Properties
.kernel_time
Period
1 hour
| * Results in a true/false |
files ".kernel_time" of folders "Library" of folders of folders "/Users"
.kernel_pid
Period
1 hour
| * Results in a true/false |
files ".kernel_pid" of folders "Library" of folders of folders "/Users"
kernel_service
Period
1 hour
| * Results in a true/false |
files "kernel_service" of folders "Library" of folders of folders "/Users"
transmission
Period
1 hour
| * Results in a true/false |
applications whose(name of it as lowercase contains "transmission")
kernel_
Period
1 hour
| * Results in a true/false |
files whose(name of it as lowercase contains "kernel_") of folders "Library" of folders of folders "/Users"
Relevance
mac of operating system
Sharing
| Social Media: |
