DevilRobber Trojan returns, masquerades as PixelMator

DevilRobber, the latest Trojan to target Mac users, got updated.

As you may remember, the previous incarnation stole Bitcoins from the user’s wallet file, used the computer’s resources to mine Bitcoins for the malware author, stole login credentials, browsing histories, the history of commands run in the Terminal and data regarding the use of Truecrypt software and TOR, and opened a backdoor into the system.

It came bundled with the popular GraphicConverter app, and would fail to install if the user has Little Snitch installed on his computer.

F-Secure researchers point out that the newly discovered Trojan is the third iteration of the malware (as indicated by its dump.txt file), and that it poses as the popular image-editing app PixelMator.

“The main point of difference in DevilRobberV3 is that it has a different distribution method — the ‘traditional’ downloader method,” they say. “The DevilRobberV3 sample that we analyzed is an FTP downloader that will download its backdoor installer package from an FTP Server service provider.”

This version of DevilRobber does not check if Little Snitch is installed before attempting to install itself, and it doesn’t take screenshots. But, it has other features that the original version is lacking – it tries to harvest the shell command history, the system log file and the contents of 1Password, the popular software for managing passwords.

Unfortunately, its Bitcoin mining and stealing capabilities are still there, as well.