What is "keranger"

KeRanger (also known as OSX.KeRanger.A) is a ransomware trojan horse targeting computers running OS X. Discovered on March 4, 2016, by Palo Alto Networks, it affected more than 7,000 Mac users.

KeRanger is remotely executed on the victim's computer from a flaw in Transmission, a popular BitTorrent client. It is hidden in the .dmg file under General.rtf. The .rtf is actually a Mach-O format executable file packed with UPX 3.91. When users click these infected apps, their bundle executable Transmission.app/Content/MacOS/Transmission will copy this General.rtf file to ~/Library/kernel_service and execute this “kernel_service” before any user interface appearing. It encrypts the files with RSA and RSA public key cryptography, with the key for decryption only stored on the attacker's servers. The malware then creates a file, called "readme_to_decrypt.txt", in every folder. When the instructions are opened, it gives the victim directions on how to decrypt the files, usually demanding a payment of one Bitcoin. The ransomware is considered to be a variant of the Linux ransomware Linux.Encoder.1.