evilquest | 07cc5df0fe22a12b51fc6a48722c4f87d662513e534d5833f46604ee4e40ba96 | Triage

Submit
Reports

Overview

overview

Static

static

030ec1a7d7...kes118

macos-10.15-amd64

Sharing

General

Target

030ec1a7d7c28f0c6cab4c4c55281cb0_JaffaCakes118
Size

168KB
Sample

240427-mmrfjshd3x
MD5

030ec1a7d7c28f0c6cab4c4c55281cb0
SHA1

9f29735cabff9ecaab52bb461623cb94d0d83f07
SHA256

07cc5df0fe22a12b51fc6a48722c4f87d662513e534d5833f46604ee4e40ba96
SHA512

309ae10d5f61e52212ae32f18bab0e00fc94bcd4e9b3fee68e2747209d3230156c4173c4cffccf6d07ac0fcee9f273f7be5e919233ae78aac8c5eeac22c5e352
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9rzFe50:5SeOQdaZNxtk8cqhSxvHY9rzFe

Score

10^/10

evilquest backdoor evasion execution macos persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

030ec1a7d7c28f0c6cab4c4c55281cb0_JaffaCakes118

Resource

macos-20240410-en

evilquest backdoor evasion execution persistence

macos-10.15-amd64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  030ec1a7d7c28f0c6cab4c4c55281cb0_JaffaCakes118
- Size
  
  168KB
- MD5
  
  030ec1a7d7c28f0c6cab4c4c55281cb0
- SHA1
  
  9f29735cabff9ecaab52bb461623cb94d0d83f07
- SHA256
  
  07cc5df0fe22a12b51fc6a48722c4f87d662513e534d5833f46604ee4e40ba96
- SHA512
  
  309ae10d5f61e52212ae32f18bab0e00fc94bcd4e9b3fee68e2747209d3230156c4173c4cffccf6d07ac0fcee9f273f7be5e919233ae78aac8c5eeac22c5e352
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9rzFe50:5SeOQdaZNxtk8cqhSxvHY9rzFe
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
- Launch Daemon
  Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence

© 2018-2024

Terms | Privacy