evilquest | 010f7558c568939909474526e828951dbedb7e38eac83513ddfde0ad97d3e7b8 | Triage

Submit
Reports

Overview

overview

Static

static

023100d3da...kes118

macos-10.15-amd64

Sharing

General

Target

023100d3daade2df9fab787af701fcf5_JaffaCakes118
Size

168KB
Sample

240427-cqpq1sha47
MD5

023100d3daade2df9fab787af701fcf5
SHA1

0033813dc489d8b8e4d60daedf3b5ce085bae096
SHA256

010f7558c568939909474526e828951dbedb7e38eac83513ddfde0ad97d3e7b8
SHA512

2488bbf84ef0419157a3a956a9eabbac70333c7335b7897ab6cca0f57a32b0b255b470f612bb945ed74dded1db24ff7be5733b550b0693334599aba66b278b2d
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9e0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution macos persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

023100d3daade2df9fab787af701fcf5_JaffaCakes118

Resource

macos-20240410-en

evilquest backdoor evasion execution persistence

macos-10.15-amd64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  023100d3daade2df9fab787af701fcf5_JaffaCakes118
- Size
  
  168KB
- MD5
  
  023100d3daade2df9fab787af701fcf5
- SHA1
  
  0033813dc489d8b8e4d60daedf3b5ce085bae096
- SHA256
  
  010f7558c568939909474526e828951dbedb7e38eac83513ddfde0ad97d3e7b8
- SHA512
  
  2488bbf84ef0419157a3a956a9eabbac70333c7335b7897ab6cca0f57a32b0b255b470f612bb945ed74dded1db24ff7be5733b550b0693334599aba66b278b2d
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9e0:5SeOQdaZNxtk8cqhSxvHY9
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
- Launch Daemon
  Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence

© 2018-2024

Terms | Privacy