Hunting for macOS Ransomware Using VirusTotal Enterprise

ARRR-Ransomware for macOS be-out there ‘laddies’, and we are going to find it!
Join me as we embark on a wild adventure to sail the deepest and darkest seas on the hunt for macOS ransomware. BONUS: We’ve added a surprise for the latest ransomware for macOS, which occurred during the preliminary writing of this article.

Introduction

Welcome to the second part of my two-part ransomware series. In the first part [1], we discussed the future of ransomware for macOS, and raised awareness of how things are unfolding in the macOS world when it comes to malware and ransomware. In this second part, we’ll go over some technical pieces in hunting macOS ransomware using VirusTotal Enterprise. 

You can also read my other VirusTotal Enterprise usage articles [2], [3], [4] where I demonstrate using VirusTotal Enterprise for various investigative tasks involving malware and the like.

Whether you call it ransomware or an 'encryption event', this type of malware is no joke. However, due to constant media and overall 'alert fatigue', many don’t give it the weight it deserves in how dangerous it actually is. 

In my previous article, we discussed the number of bad things that can happen other than just holding your data for ransom in an encrypted state, which lots of laymen think is the major difference between....