WindShift.app malware

2024-01-02: Site is back on track, self-hosted on a rpi because you get the Internet you fund. 2025-02-06: Oh well, some power grid issues caused the rpi to reboot, I really should configure uwsgi to restart automatically --'

e2e77a08-f458-36c1-b7bd-99f409b4deac
WindShift.app malware

Version	3
Variant	specified in RFC 4122
urn	urn:uuid:e2e77a08-f458-36c1-b7bd-99f409b4deac
Hexdump	e2e77a08f45836c1b7bd99f409b4deac
Bytes	Γτz␈⌠X6┴╖╜Ö⌠␉┤▐¼
UUIDv3	version (3) + MD5(namespace,payload)
Hash algorithm	MD5
(would-be) MAC Address	99f409b4deac
(would-be) is_local bit	True
(would-be) is_multicast bit	False
(would-be) MAC Manufacturer	None
(would-be) MAC Date	None

UUID registration form :

BundleClass: kLSBundleClassApplication
Container mount state: mounted
bundle  id:            168204
 Mach-O UUIDs:  E2E77A08-F458-36C1-B7BD-99F409B4DEAC
 Device Familie
  Counterpart ID
  sequenceNum:   168204
 FamilyID:      0
  PurchaserID:   0
  DownloaderID:  0
  installType:   0
  appContainer:  #
  dataContainer: #
  path:          /Users/patrick/Projects/WindShift/DerivedData/WindShift/Build/Products/Debug/WindShift.app
 name:          WindShift
  ....
  executable:    Contents/MacOS/WindShift
 ....

  CFBundleURLTypes =     (
                {
            CFBundleURLName = "com.foo.bar.WindShift";

0 https://objective-see.com/blog/blog_0x38.html

e2e77a08-f458-36c1-b7bd-99f409b4deacWindShift.app malware

e2e77a08-f458-36c1-b7bd-99f409b4deac
WindShift.app malware