EtreCheck is Malware

Is EtreCheck safe? NO!

EtreCheck does not meet Apple's standard for acceptance into the official App Store.

Don't be fooled by those high-level users on Apple Support Communities no matter what level they are. This is social engineering done to make you think it's perfectly ok to download an unknown program from the internet that can't make it into the App Store. Numerous versions of EtreCheck have been proven to contain malicious code and contact IP addresses that are known to host malware files according to top anti-virus companies including McAfee, TrendMicro, AVG, Avast, AegisLab, and more.

What better way to disguise malware than as a "friendly checkup" app that helps you diagnose "beach-balling" and remove "bloatware"? In computing, a trojan horse is defined as a program designed to breach the security of a computer system while ostensibly performing some innocuous function. Who would think that something that is supposed to fix problems is actually a problem itself? There have similarly been cases of virus scan software that actually was malware itself.

EtreCheck may identify some issues your computer has but who cares if it also gets administrator access to your computer, installs a command and control server, and can do things like access your files and webcam without you knowing? That's exactly what reverse engineering of the program has discovered it is capable of doing. It's not a totally useless program because, in addition to its clandestine activities, it also might help people remove other competing malware programs.

It seems a technique called social engineering is being used to trick users and convince them that it is safe to download EtreCheck since it is being recommended by a high-ranking forum user or multiple users.

Since many users have an innate trust in all things Apple, they understandably are under the impression that these high-ranking forum users are either actual Apple employees or thoroughly vetted by Apple who would surely act to stop such widespread victimization of its customers.

Unfortunately, Apple maintains that these users are not Apple employees and that Apple does not verify the statements made in these forums. Even though there is some moderation, it's typically for clear violations like a post containing personal information or profanity.

Those high-level user accounts commonly make statements like "delete your antivirus software," "there's no such thing as malware for Macs," and repeat the same conclusions over and over again without offering the slightest bit of proof or references. If you try to confront an EtreCheck pusher with evidence they will make up any excuse why you're wrong, simply ignore you, or resort to insults instead of engaging in productive dialogue. It almost seems as if Apple condones this to help maintain their image as a magically superior operating system that isn't affected by the vary same issues that made customers switch over to them in the first place.

macOS does definitely have some additional protections built in and Apple does patch known exploits and has in every single upgrade you've installed probably ever, but that doesn't mean that the exploits didn't exist. They can only address known exploits that get reported to them either threw the US governments official reporting mechanism NIST's National Vunerability Database Common

You may have heard of the program which claims to help people identify and resolve problems with their Mac. It is continuously recommended on the Apple-sponsored support forum as a "friendly checkup". A user would be inclined to trust the recommendations of the high-ranking users whose countless hours, days, and years have been spent answering questions, surely out of the goodness of their hearts, right?

Not necessarily...

But either way, it's safe to assume that everything is verified by an all-knowing genius Apple moderator, right?

Unfortunately, that assumption may have convinced more than 500,000 people to download the trojan horse malware directly from the developer's website, since it's unavailable in the official App Store.

How this has been allowed to continue all these years is frankly sad and one can only assume it simply hasn't come to the attention of the right person who could put a stop to it or that Apple is too embarrassed to admit such a mistake. The belief that Apple products are immune to compromise has slowly been degraded over the years as a result of various incidents admitting fault here could draw the ire of countless users and even result in legal repercussions for Apple as a result of their failure to act and protect their customers.

The proof of EtreCheck's malicious activity isn't difficult to identify and can easily be seen by using various free malware analysis tools online. VirusTotal is one such tool that detects malware using data from more than 60 of the largest anti-virus company's databases of malware threats. It's like running 60+ different anti-virus scans on a file at once and seeing if any of them detect any signatures of code they've previously identified as malware.

A report of the software developer's website shows that many versions of Etrecheck have been uploaded to VirusTotal and have been identified as malware or are closely related to malicious files, IP addresses, and display other indicators of compromise by highly trusted names like McAfee, AVG, TrendMicro, Avast and AegisLab, the MITRE Corporation (a non-profit at the intersection of computer science and national defense), Snort, VirusTotal, Bro, Crowdstrike/Hybrid Analysis.

The graph below was generated by VirusTotal and illustrates the complex manner in which EtreCheck operates. It was made using a 2018 version of the program which can be confirmed by looking at the unique identifier, it's sha256 digest (the long string under File Name that starts with b37424). This number is calculated using one of a number of formulas that allows any computer to arrive at the same string of characters for the same file if it contains exactly the same data inside of it. If there are any changes made to the data contents, the string of characters will not be the same. Security features like encryption, certificate authorities, and code signing use their preferred algorithm to make sure that the string of characters matches what is expected.

It's safe to assume that the data sent to Virus Total is in fact the file it claims to be, an authentic version of EtreCheck. The certificate allows us to know that this is almost certainly the file the developer intended it to be.

The program also recently was confirmed making communications with a known malware server (shown below) which the developer later claimed he had no idea why.

Debunking Myths About the Trustworthiness of Etrecheck and Etresoft