30K Macs are infected with ‘Silver Sparrow’ virus and no one knows why

Re:30K Macs are infected with ‘Silver Sparrow’ virus and no ... by supernova87a on Monday February 22, 2021 @01:58PM (#26228801)

Is there an "approved" diagnostic tool that one should use to figure out whether your mac has the virus, or is vulnerable to it and needs patching?

[ Parent | on HN ]

Re:30K Macs are infected with ‘Silver Sparrow’ virus and no ... by kennywinker on Monday February 22, 2021 @02:06PM (#26228923)

Check for the existence of these files:

~/Library/._insu (empty file used to signal the malware to delete itself)

/tmp/agent.sh (shell script executed for installation callback)

/tmp/version.json (file downloaded from from S3 to determine execution flow)

/tmp/version.plist (version.json converted into a property list)

[ Parent | on HN ]

Re:30K Macs are infected with ‘Silver Sparrow’ virus and no ... by klaushardt on Monday February 22, 2021 @02:46PM (#26229549)

[ Parent | on HN ]

Re:30K Macs are infected with ‘Silver Sparrow’ virus and no ... by prox on Monday February 22, 2021 @02:02PM (#26228856)

I think Malwarebytes was the company first identifying the thread. Correction : it was Red Canary working with Malwarebytes.

[ Parent | on HN ]