evilquest | 57a7d3eb27faf33e5294e087b6cdb21392ff6dce7053d945940e670e5e196239 | Triage

Submit
Reports

Overview

overview

Static

static

01ffe9ebdd...kes118

macos-10.15-amd64

Sharing

General

Target

01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118
Size

337KB
Sample

240427-arvmjsfb49
MD5

01ffe9ebdd78db6fdda14ebcfde59a6f
SHA1

1d1625a4987c1575ecf0391dc3b87f18c2c2ed09
SHA256

57a7d3eb27faf33e5294e087b6cdb21392ff6dce7053d945940e670e5e196239
SHA512

3cbf9ae42de78e0ef7055a8775a3511b46bcdcad47a9a7ab236d2a77152660d68ff80c16997ed9fe2e0c35d0fae52278bd372f35d7b06457575bc626ab01b810
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9+1rxZSeOQdaZNxtk8cqhSxvHY9:5LOQdaDxq8cqavHYYLOQdaDxq8cqavHY

Score

10^/10

evilquest backdoor evasion execution macos persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118

Resource

macos-20240410-en

evilquest backdoor evasion execution persistence

macos-10.15-amd64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  01ffe9ebdd78db6fdda14ebcfde59a6f_JaffaCakes118
- Size
  
  337KB
- MD5
  
  01ffe9ebdd78db6fdda14ebcfde59a6f
- SHA1
  
  1d1625a4987c1575ecf0391dc3b87f18c2c2ed09
- SHA256
  
  57a7d3eb27faf33e5294e087b6cdb21392ff6dce7053d945940e670e5e196239
- SHA512
  
  3cbf9ae42de78e0ef7055a8775a3511b46bcdcad47a9a7ab236d2a77152660d68ff80c16997ed9fe2e0c35d0fae52278bd372f35d7b06457575bc626ab01b810
- SSDEEP
  
  6144:5SeOQdaZNxtk8cqhSxvHY9+1rxZSeOQdaZNxtk8cqhSxvHY9:5LOQdaDxq8cqavHYYLOQdaDxq8cqavHY
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
- Launch Daemon
  Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence

© 2018-2024

Terms | Privacy