Overview

overview

10

Static

static

10

evilquest

macos_amd64

10

Resubmissions

11/03/2022, 16:25

220311-txctgaaca710

11/03/2022, 16:25

220311-tw47bsdcdm10

08/11/2021, 16:32

211108-t2f2pacfg710

08/11/2021, 16:30

211108-tzsygahgcn10

08/11/2021, 16:22

211108-tvqybahgbp10

Analysis

  • max time network
    300s
  • platform
    macos_amd64
  • resource
    macos
  • submitted
    08/11/2021, 16:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    evilquest
  • Size 85KB
  • Sample211108-t2f2pacfg7
  • SHA256 5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b
  • MD5 SHA1 SHA512
Score
10/10
evilquestbackdoor

Malware Config

Signatures

  • EvilQuest

    EvilQuest family.

    backdoorevilquest
  • EvilQuest Payload 34 IoCs

Processes

  • /bin/sh
    sh -c "sudo /Users/run/evilquest"
    1⤵
      PID:486
    • /bin/bash
      sh -c "sudo /Users/run/evilquest"
      1⤵
        PID:486
      • /usr/bin/sudo
        sudo /Users/run/evilquest
        1⤵
          PID:486
          • /Users/run/evilquest
            /Users/run/evilquest
            2⤵
              PID:496
          • /bin/sh
            sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
            1⤵
              PID:501
            • /bin/bash
              sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
              1⤵
                PID:501
              • /usr/bin/osascript
                osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                1⤵
                  PID:501
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.security.authtrampoline
                  1⤵
                    PID:502
                  • /System/Library/Frameworks/Security.framework/authtrampoline
                    /System/Library/Frameworks/Security.framework/authtrampoline
                    1⤵
                      PID:502
                    • /bin/sh
                      /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                      1⤵
                        PID:503
                      • /bin/bash
                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                        1⤵
                          PID:503
                          • /bin/launchctl
                            launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                            2⤵
                              PID:504
                            • /bin/launchctl
                              launchctl start questd
                              2⤵
                                PID:506
                            • /usr/libexec/xpcproxy
                              xpcproxy questd
                              1⤵
                                PID:505
                              • /usr/bin/sudo
                                sudo /Library/AppQuest/com.apple.questd --silent
                                1⤵
                                  PID:505
                                  • /Library/AppQuest/com.apple.questd
                                    /Library/AppQuest/com.apple.questd --silent
                                    2⤵
                                      PID:511
                                  • /bin/sh
                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                    1⤵
                                      PID:507
                                    • /bin/bash
                                      sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                      1⤵
                                        PID:507
                                      • /usr/bin/osascript
                                        osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                        1⤵
                                          PID:507
                                        • /bin/sh
                                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                          1⤵
                                            PID:508
                                          • /bin/bash
                                            /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                            1⤵
                                              PID:508
                                              • /bin/launchctl
                                                launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                2⤵
                                                  PID:509
                                                • /bin/launchctl
                                                  launchctl start questd
                                                  2⤵
                                                    PID:510
                                                • /bin/sh
                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                  1⤵
                                                    PID:513
                                                  • /bin/bash
                                                    sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                    1⤵
                                                      PID:513
                                                    • /usr/bin/osascript
                                                      osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                      1⤵
                                                        PID:513
                                                      • /bin/sh
                                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                        1⤵
                                                          PID:534
                                                        • /bin/bash
                                                          /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                          1⤵
                                                            PID:534
                                                            • /bin/launchctl
                                                              launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                              2⤵
                                                                PID:535
                                                              • /bin/launchctl
                                                                launchctl start questd
                                                                2⤵
                                                                  PID:536
                                                              • /bin/sh
                                                                sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                1⤵
                                                                  PID:537
                                                                • /bin/bash
                                                                  sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
                                                                  1⤵
                                                                    PID:537
                                                                  • /usr/bin/osascript
                                                                    osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\" with administrator privileges"
                                                                    1⤵
                                                                      PID:537
                                                                    • /bin/sh
                                                                      /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                      1⤵
                                                                        PID:545
                                                                      • /bin/bash
                                                                        /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd"
                                                                        1⤵
                                                                          PID:545
                                                                          • /bin/launchctl
                                                                            launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist
                                                                            2⤵
                                                                              PID:546
                                                                            • /bin/launchctl
                                                                              launchctl start questd
                                                                              2⤵
                                                                                PID:547

                                                                            Network

                                                                                  MITRE ATT&CK Matrix

                                                                                  Replay Monitor

                                                                                  Loading Replay Monitor...

                                                                                  Downloads