evilquest | 1f0b2aae15c2fcb877ea0ce208ecaedb55c39d761c2b4a560620a175bd1c9cc8 | Triage

Sharing

General

Target

2024-03-08_fbe17c0c3d3d24def0a8affd3647b918_adload_evilquest
Size

305KB
Sample

240308-ta5kzabg9z
MD5

fbe17c0c3d3d24def0a8affd3647b918
SHA1

3ea6401d3190358422f9381f83963cc939a93f96
SHA256

1f0b2aae15c2fcb877ea0ce208ecaedb55c39d761c2b4a560620a175bd1c9cc8
SHA512

d473f8cad7c8feb6291e5cef12b6e3bba68e58cf8b6305330e7a754220a9a14ad81aabf411c8d15af6ee0d8a1e3e51cdbdd7d2f7c26381c883c8d6b3487b99b4
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9ZuZfN755Sx8GpdlXmVkO:5LOQdaDxq8cqavHYS75kxkj

Score

10^/10

evilquest backdoor execution macos persistence

Malware Config

Targets

- Target
  
  2024-03-08_fbe17c0c3d3d24def0a8affd3647b918_adload_evilquest
- Size
  
  305KB
- MD5
  
  fbe17c0c3d3d24def0a8affd3647b918
- SHA1
  
  3ea6401d3190358422f9381f83963cc939a93f96
- SHA256
  
  1f0b2aae15c2fcb877ea0ce208ecaedb55c39d761c2b4a560620a175bd1c9cc8
- SHA512
  
  d473f8cad7c8feb6291e5cef12b6e3bba68e58cf8b6305330e7a754220a9a14ad81aabf411c8d15af6ee0d8a1e3e51cdbdd7d2f7c26381c883c8d6b3487b99b4
- SSDEEP
  
  6144:5SeOQdaZNxtk8cqhSxvHY9ZuZfN755Sx8GpdlXmVkO:5LOQdaDxq8cqavHYS75kxkj
Score

10^/10

evilquest backdoor execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  persistence
- Launch Daemon
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorexecutionpersistence