I noticed this in Little Snitch:

Total: 444 B sent, 0 B received
    Outgoing to xmr.pool.minergate.com (,, Port 45700, Protocol TCP (6), 222 B sent, 0 B received
    Outgoing to xmr.pool.minergate.com (,, Port 45700, Protocol TCP (6), 222 B sent, 0 B received

I blocked it but couldn't stop it from reloading. I couldn't find it in LaunchControl. (I never installed qemu via Homebrew.)

Is this some kind of bitcoin mining malware? Any way to figure out where it came from?

For now I just deleted the binary.

  • qemu is a virtual mackine/emulator, It isself is not malware. However what it runs could be anything. As it was installed via Homebrew something you installed via Homebrew installed it. – Mark Dec 19 '18 at 21:39

Qemu is a virtual emulator. Minergate is mining software. As mentioned it is probably installed via something you installed by Homebrew.

I would recommend a AntiVirus


After some digging, since I also have the same thing, I found that it is a crypto mining malware that can be bundled with software, notably pirated softs.

I checked out "/usr/local/Cellar/qemu/3.0.0/bin/qemu-system-x86_64" and found other files.

Check around for a couple other files. I found a background agent that is linked at "/usr/libexec/AppleQEMUGuestAgent", which leads also to a .plist file at "/System/Library/LaunchDaemons/com.apple.AppleQEMUGuestAgent.plist". Judging by the lines inside the plist, it probably is. Also, If you find that your mac fan is throttling but you are not using and heavy apps, it is also a very clear indicator that cryptocurrency mining malware is present. Good thing you deleted the binary.

One more thing, I also found a bunch of files that are related through going to finder, pressing Command-Shift-G and typing "/System" (no brackets for any of the directories). I then put in the search bar "qemu" and clicked on the "system" button instead of This Mac, and that is how I found a plist file that is stated. BUT PLEASE READ. Instead of searching qemu, I searched instead "x86_64" (no brackets). This brought up a couple files, like 8. Delete them too. If you check them out, they all seem to be linked to mining. check the files out yourself in an app such as TextEdit, and hopefully you will see the same.

ALL OF THE FILES STATED HERE SHOULD BE DELETED, well, at least I did. If you do not have nessasary perms, even when sudo, try disabling SIP, deleting the files, then RE-ENABLE SIP.

Hope this helps someone.

Sources(if u wanna check them out, i also did my own searching):

  • and the moral of this story is...don't install pirated software – Wilfred Smith Apr 30 at 16:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .