Overview

overview

10

Static

static

10

2024-03-29...lquest

macos-10.15-amd64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest

  • Size

    177KB

  • Sample

    240329-1s53saag4w

  • MD5

    f3244d2c6c2101018393cff17585ace5

  • SHA1

    febccd9656495e33cd2cc421d10113619b0efcdc

  • SHA256

    f05d9df0145f193c2dc00c475311438853872c1d9c03821fb1be7b1ee1836204

  • SHA512

    c8dc9f5bc2315fcbcf24e345647a944c7d1fc195ab8a91110fcb61002df18f803b86da4ae65742716c893c3110fcdda21789a8249154960b6ad964f1ea8ef6cb

  • SSDEEP

    3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Zd20t:5SeOQdaZNxtk8cqhSxvHY9n

Score
10/10
evilquestbackdoorevasionexecutionmacospersistence

Malware Config

Targets

    • Target

      2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest

    • Size

      177KB

    • MD5

      f3244d2c6c2101018393cff17585ace5

    • SHA1

      febccd9656495e33cd2cc421d10113619b0efcdc

    • SHA256

      f05d9df0145f193c2dc00c475311438853872c1d9c03821fb1be7b1ee1836204

    • SHA512

      c8dc9f5bc2315fcbcf24e345647a944c7d1fc195ab8a91110fcb61002df18f803b86da4ae65742716c893c3110fcdda21789a8249154960b6ad964f1ea8ef6cb

    • SSDEEP

      3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Zd20t:5SeOQdaZNxtk8cqhSxvHY9n

    Score
    10/10
    evilquestbackdoorevasionexecutionpersistence

    • EvilQuest

      EvilQuest family.

      backdoorevilquest

    • EvilQuest payload

    • Launch Agent

      Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.

      persistence

    • Launch Daemon

      Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

AppleScript

1
T1059.002

System Services

1
T1569

Launchctl

1
T1569.001

Persistence

Create or Modify System Process

2
T1543

Launch Agent

1
T1543.001

Launch Daemon

1
T1543.004

Privilege Escalation

Create or Modify System Process

2
T1543

Launch Agent

1
T1543.001

Launch Daemon

1
T1543.004

Defense Evasion

Hide Artifacts

1
T1564

Resource Forking

1
T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks