OSX.EvilEgg
Short bio
OSX.EvilEgg is Malwarebytes’detection name for a macOs app named CoinTicker that installs two different backdoors.
Symptoms
The CoinTicker app, on the surface, appears to be a legitimate application that could potentially be useful to someone who has invested in cryptocurrencies. The app puts an icon in the menu bar that gives information about the current price of Bitcoin.
Type and source of infection
When OSX.EvilEgg is launched, the app will download and install components of two different open-source backdoors: EvilOSX and EggShell.
Aftermath
It seems likely that OSX.EvilEgg is meant to be used to gain access to users cryptocurrency wallets, for the purpose of stealing coins.
Protection
Malwarebytes for Mac detects and removes OSX.EvilEgg.
Traces/IOCs
Folder: .UpQZdhkKfCdSYxg
Python script: plQqVfeJvGo
User launch agent: com.apple.EOFHXpQvqhr.plist
Network connections: 94.156.189.77:2280 185.206.144.226:1339
