Suspicious software reappearing despite factory resetting Macbook Pro

[KYSH]

MacBook Pro (15-inch, 2018)

2.6 GHz 6-Core Intel Core i7

32 GB 2400 MHz DDR4

Intel UHD Graphics 630 1536 MB

 

I had downloaded a pirated software 3 years ago, which I had it deleted soon after realising my laptop was noticeably slow.

Despite having factory reset my laptop several times (with a few occasions where I had to take it to Apple authorised reseller/repair shop due to errors during the process),

occasionally the same pirated software reappears in my Applications folder. Deleted it every time but I'm concerned that my Macbook Pro is damaged with rootkits.

Could this be because this software is still existing in my iCloud? 

 

 

[KYSH]

Personal References

/System/Volumes/Data/Applications/Maxon Cinema 4D R25/resource/modules/licensing.module/html/id-dev/assets/css/libs/fontawesome/webfonts/fa-solid-900.woff

› /System/Volumes/Data/Applications/Maxon Cinema 4D R25/resource/modules/licensing.module/html/my/assets/css/libs/fontawesome/webfonts/fa-solid-900.woff

 

/System/Volumes/Data/Applications/Maxon Cinema 4D R25/resource/modules/licensing.module/html/id-dev/assets/css/libs/fontawesome/webfonts/fa-solid-900.woff

› /System/Volumes/Data/Applications/Maxon Cinema 4D R25/resource/modules/licensing.module/html/my/assets/css/libs/fontawesome/webfonts/fa-solid-900.woff

[treed]

The process that is triggering these RansomWhere alerts is:

/Library/Application Support/Adobe/Keyfiles/AfterEffects/22/CustomHooks/Maxon Cinema 4D Full Installer.app

Is Maxon Cinema 4D the program you downloaded from the piracy site? If so, I'm guessing it was never completely removed, and the installer is still there - migrated from backups after factory resets - with Adobe trying to run it periodically. I'm guessing something about the installation process is triggering RansomWhere... probably the writing of files with a high level of entropy (randomness).

What I'd recommend doing is to fully remove your Adobe software, ensuring that the /Library/Application Support/Adobe/ folder is removed in the process. Then reinstall Adobe from scratch.

[KYSH]

Because of this problem persisting, I tried using no backups after a factory reset. And it appeared again.

Would this mean I must delete everything on iCloud?

I will try out your suggestion- Thank you.

[treed]

This would have nothing to do with iCloud. It's not possible for something like this to persist after erasing the hard drive unless it is somehow copied back to the machine from some form of backup, or unless it was reinstalled.

I use other Adobe software, but not AfterEffects, so I'm unfamiliar with that. Is it possible that the Maxon Cinema 4D Full Installer.app in that location is installed automatically as part of AfterEffects? If not, what else did you install after wiping the hard drive? Did you copy any data manually from backups?