und so kann man prüfen ob man infiziert ist....


Once opened, the app seems to be what it pretends to be, and there’s no sign of any monkey business. The app does not request an admin password, which might tip off a savvy user, or do anything else unexpected. However, in reality, by the time the user sees the window shown here, the app has already dropped its payload into the system.

CoinThief extensionThe first thing the app installs is a browser extension, in both Safari and Chrome (if installed). This extension is deceptively-named “Pop-Up Blocker” and claims to have been made by someone named Eric Wong. Clicking the link to visit the developer’s site goes to the KangoExtensions website. It’s unclear at this time whether KangoExtensions actually has something to do with this malware or whether their identity was stolen for the purpose of making the extension seem more convincing. (Personally, my money would be on the latter… it’s very unlikely that the hacker involved would give himself credit and link to his own site.) It is possible, though, that the Kango framework was used to create the malicious extension.

In addition to the browser extensions, the malware also installs a LaunchAgent that keeps a process alive. The LaunchAgent is placed here:

~/Library/LaunchAgents/com.google.softwareUpdateAgent.plist
This obviously seems to belong to Google, but it actually does not. The process that this LaunchAgent keeps running is stored here:

~/Library/Application Support/.com.google.softwareUpdateAgent/com.google.softwareUpdateAgent

man beachte den Punkt (.) nach Support/ ... also vorher erst die unsichtbaren Verzeichnisse sichtbar machen...

Also ich stehe dem Bitcoin eh sehr skeptisch gegenüber. Weiß nicht ob das so optimal ist.

Somit kostet die Raubkopie nun doch was
Traurig, das so eine preiswerte Software überhaupt geklaut wird...

Ich habe kein Mitleid, wenn einem, der Software klaut, etwas geklaut wird.