evilquest | faa6a7efb0082e3fcda5a14d5020d77be3eff8855a017ee838d34fb2d462d5de | Triage

Sharing

General

Target

2024-03-04_c359f68433f3ea967d87e905bc4e103f_adload_evilquest
Size

182KB
Sample

240304-pq47xsac7t
MD5

c359f68433f3ea967d87e905bc4e103f
SHA1

f495fcde41486cfd8be217d0d96dd9d7f28a359f
SHA256

faa6a7efb0082e3fcda5a14d5020d77be3eff8855a017ee838d34fb2d462d5de
SHA512

5906ad687cf097c542840013e0d5ed66e96389587b516df8c24e69bd72a4ad81d7968d5385296c518054c244a4aaf3126a655b2afd52377219ef52eb26f809c4
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9py04Gd:5SeOQdaZNxtk8cqhSxvHY9IGd

Score

10^/10

evilquest backdoor execution macos persistence

Malware Config

Targets

- Target
  
  2024-03-04_c359f68433f3ea967d87e905bc4e103f_adload_evilquest
- Size
  
  182KB
- MD5
  
  c359f68433f3ea967d87e905bc4e103f
- SHA1
  
  f495fcde41486cfd8be217d0d96dd9d7f28a359f
- SHA256
  
  faa6a7efb0082e3fcda5a14d5020d77be3eff8855a017ee838d34fb2d462d5de
- SHA512
  
  5906ad687cf097c542840013e0d5ed66e96389587b516df8c24e69bd72a4ad81d7968d5385296c518054c244a4aaf3126a655b2afd52377219ef52eb26f809c4
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9py04Gd:5SeOQdaZNxtk8cqhSxvHY9IGd
Score

10^/10

evilquest backdoor execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  persistence
- Launch Daemon
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorexecutionpersistence