{"action":"created","issue":{"url":"https://api.github.com/repos/facebook/osquery/issues/1899","repository_url":"https://api.github.com/repos/facebook/osquery","labels_url":"https://api.github.com/repos/facebook/osquery/issues/1899/labels{/name}","comments_url":"https://api.github.com/repos/facebook/osquery/issues/1899/comments","events_url":"https://api.github.com/repos/facebook/osquery/issues/1899/events","html_url":"https://github.com/facebook/osquery/pull/1899","id":138856154,"number":1899,"title":"Add detection for KeRange Ransomware","user":{"login":"friedbutter","id":6203418,"avatar_url":"https://avatars.githubusercontent.com/u/6203418?v=3","gravatar_id":"","url":"https://api.github.com/users/friedbutter","html_url":"https://github.com/friedbutter","followers_url":"https://api.github.com/users/friedbutter/followers","following_url":"https://api.github.com/users/friedbutter/following{/other_user}","gists_url":"https://api.github.com/users/friedbutter/gists{/gist_id}","starred_url":"https://api.github.com/users/friedbutter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/friedbutter/subscriptions","organizations_url":"https://api.github.com/users/friedbutter/orgs","repos_url":"https://api.github.com/users/friedbutter/repos","events_url":"https://api.github.com/users/friedbutter/events{/privacy}","received_events_url":"https://api.github.com/users/friedbutter/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2016-03-07T00:51:06Z","updated_at":"2016-03-07T00:55:43Z","closed_at":"2016-03-07T00:55:43Z","pull_request":{"url":"https://api.github.com/repos/facebook/osquery/pulls/1899","html_url":"https://github.com/facebook/osquery/pull/1899","diff_url":"https://github.com/facebook/osquery/pull/1899.diff","patch_url":"https://github.com/facebook/osquery/pull/1899.patch"},"body":"From the blog:  http://researchcenter.paloaltonetworks.com/2016/03/new-os-x-ransomware-keranger-infected-transmission-bittorrent-client-installer\r\n\r\n1. Using either Terminal or Finder, check whether /Applications/Transmission.app/Contents/Resources/ General.rtf or /Volumes/Transmission/Transmission.app/Contents/Resources/ General.rtf exist. If any of these exist, the Transmission application is infected and we suggest deleting this version of Transmission.\r\n2. Using “Activity Monitor” preinstalled in OS X, check whether any process named “kernel_service” is running. If so, double check the process, choose the “Open Files and Ports” and check whether there is a file name like “/Users/<username>/Library/kernel_service” (Figure 12). If so, the process is KeRanger’s main process. We suggest terminating it with “Quit -> Force Quit”.\r\n3. After these steps, we also recommend users check whether the files “.kernel_pid”, “.kernel_time”, “.kernel_complete” or “kernel_service” existing in ~/Library directory. If so, you should delete them."},"comment":{"url":"https://api.github.com/repos/facebook/osquery/issues/comments/193027020","html_url":"https://github.com/facebook/osquery/pull/1899#issuecomment-193027020","issue_url":"https://api.github.com/repos/facebook/osquery/issues/1899","id":193027020,"user":{"login":"friedbutter","id":6203418,"avatar_url":"https://avatars.githubusercontent.com/u/6203418?v=3","gravatar_id":"","url":"https://api.github.com/users/friedbutter","html_url":"https://github.com/friedbutter","followers_url":"https://api.github.com/users/friedbutter/followers","following_url":"https://api.github.com/users/friedbutter/following{/other_user}","gists_url":"https://api.github.com/users/friedbutter/gists{/gist_id}","starred_url":"https://api.github.com/users/friedbutter/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/friedbutter/subscriptions","organizations_url":"https://api.github.com/users/friedbutter/orgs","repos_url":"https://api.github.com/users/friedbutter/repos","events_url":"https://api.github.com/users/friedbutter/events{/privacy}","received_events_url":"https://api.github.com/users/friedbutter/received_events","type":"User","site_admin":false},"created_at":"2016-03-07T00:55:43Z","updated_at":"2016-03-07T00:55:43Z","body":"duplicated request #1898 "}}