evilquest | 434c25c65e506cf311b4316f846792d0847e0bf19cc92c239da19ef019754fbe | Triage

Sharing

General

Target

02aff8971859142ae5d950b5e991d016_JaffaCakes118
Size

168KB
Sample

240427-hw4d9ade45
MD5

02aff8971859142ae5d950b5e991d016
SHA1

1d5e35994285867249e424af00daf25b1e64c479
SHA256

434c25c65e506cf311b4316f846792d0847e0bf19cc92c239da19ef019754fbe
SHA512

a93c5e028e139f2fa055b77863bde33eff7e3504af043e0f0998028bed45f9d007e42679a9a91cd8dc29e63b2fdae48c889a337352f3a658d3fc13df96ae983c
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9m0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest execution macos persistence

Malware Config

Targets

- Target
  
  02aff8971859142ae5d950b5e991d016_JaffaCakes118
- Size
  
  168KB
- MD5
  
  02aff8971859142ae5d950b5e991d016
- SHA1
  
  1d5e35994285867249e424af00daf25b1e64c479
- SHA256
  
  434c25c65e506cf311b4316f846792d0847e0bf19cc92c239da19ef019754fbe
- SHA512
  
  a93c5e028e139f2fa055b77863bde33eff7e3504af043e0f0998028bed45f9d007e42679a9a91cd8dc29e63b2fdae48c889a337352f3a658d3fc13df96ae983c
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9m0:5SeOQdaZNxtk8cqhSxvHY9
Score

5^/10

execution persistence
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Privilege Escalation

Create or Modify System Process

Launch Agent

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistence