evilquest | 9ac73c4e9aeb339276268f6b76874a208de7c15ef0c405512d78197a30ae73dc | Triage

Sharing

General

Target

2024-02-05_68ffdf195652994741e455b40b7538d6_adload_evilquest
Size

177KB
Sample

240205-y9dczshfdr
MD5

68ffdf195652994741e455b40b7538d6
SHA1

089b1caeea2a6382981f86046591710cda222919
SHA256

9ac73c4e9aeb339276268f6b76874a208de7c15ef0c405512d78197a30ae73dc
SHA512

4508cc53676ee7ac67e65b1e69903623ffbce66187d657effd52fc8191b68a28ca5c53718edadd3b72cd36a097ebe7e6139849264f60cbd816b5d0f205d2aac5
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9F07:5SeOQdaZNxtk8cqhSxvHY9U

Score

10^/10

evilquest backdoor evasion execution macos persistence

Malware Config

Targets

- Target
  
  2024-02-05_68ffdf195652994741e455b40b7538d6_adload_evilquest
- Size
  
  177KB
- MD5
  
  68ffdf195652994741e455b40b7538d6
- SHA1
  
  089b1caeea2a6382981f86046591710cda222919
- SHA256
  
  9ac73c4e9aeb339276268f6b76874a208de7c15ef0c405512d78197a30ae73dc
- SHA512
  
  4508cc53676ee7ac67e65b1e69903623ffbce66187d657effd52fc8191b68a28ca5c53718edadd3b72cd36a097ebe7e6139849264f60cbd816b5d0f205d2aac5
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9F07:5SeOQdaZNxtk8cqhSxvHY9U
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  persistence
- Launch Daemon
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence