evilquest | da678bb2b514960be90afb6e52fb93f4e6f75ccd886fffc5cce850da9a7f4fbc | Triage

Sharing

General

Target

2024-02-15_1da57b44bc181b051b480c5d4b923728_adload_evilquest
Size

16.1MB
Sample

240215-e17qpage2z
MD5

1da57b44bc181b051b480c5d4b923728
SHA1

394e099c6dbdedc18fed2d812fbdc3eeaa46e6cb
SHA256

da678bb2b514960be90afb6e52fb93f4e6f75ccd886fffc5cce850da9a7f4fbc
SHA512

0fb47aa06ce104e315cd4a1a0ff404608bff3c93f8265729e3effb94d998a4b23fa00f1f623dfbc34c0f8439164a7be395db657d4192f79df45166ea65a55111
SSDEEP

49152:U33dQ333dQkb33dQ333dQkb33dQ333dQk333dQ333dQk933g33dQ333dQkb33dQ2:i

Score

10^/10

evilquest backdoor evasion execution macos persistence

Malware Config

Targets

- Target
  
  2024-02-15_1da57b44bc181b051b480c5d4b923728_adload_evilquest
- Size
  
  16.1MB
- MD5
  
  1da57b44bc181b051b480c5d4b923728
- SHA1
  
  394e099c6dbdedc18fed2d812fbdc3eeaa46e6cb
- SHA256
  
  da678bb2b514960be90afb6e52fb93f4e6f75ccd886fffc5cce850da9a7f4fbc
- SHA512
  
  0fb47aa06ce104e315cd4a1a0ff404608bff3c93f8265729e3effb94d998a4b23fa00f1f623dfbc34c0f8439164a7be395db657d4192f79df45166ea65a55111
- SSDEEP
  
  49152:U33dQ333dQkb33dQ333dQkb33dQ333dQk333dQ333dQk933g33dQ333dQkb33dQ2:i
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Daemon
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence