evilquest | 551302c3df37a560ae9455243191b2c9ae660e9036dc96bee8fd4a2f3c965ccf | Triage

Submit
Reports

Overview

overview

Static

static

0484d93ffa...kes118

macos-10.15-amd64

Sharing

General

Target

0484d93ffa7bdce47c10504123dabca2_JaffaCakes118
Size

168KB
Sample

240428-gpc32shg51
MD5

0484d93ffa7bdce47c10504123dabca2
SHA1

9ba50900c509814438739276830ea6b88ef67f78
SHA256

551302c3df37a560ae9455243191b2c9ae660e9036dc96bee8fd4a2f3c965ccf
SHA512

d691eb91500c0b96341be612214928f63f2413fe28ba07ca972d79ae34b3c6eb3efa9732fa828f1bcdcc37720d92165a533a375c75eca6779f786970f65af239
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9sP0:5SeOQdaZNxtk8cqhSxvHY9s

Score

10^/10

evilquest backdoor evasion execution macos persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

0484d93ffa7bdce47c10504123dabca2_JaffaCakes118

Resource

macos-20240410-en

evilquest backdoor evasion execution persistence

macos-10.15-amd64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  0484d93ffa7bdce47c10504123dabca2_JaffaCakes118
- Size
  
  168KB
- MD5
  
  0484d93ffa7bdce47c10504123dabca2
- SHA1
  
  9ba50900c509814438739276830ea6b88ef67f78
- SHA256
  
  551302c3df37a560ae9455243191b2c9ae660e9036dc96bee8fd4a2f3c965ccf
- SHA512
  
  d691eb91500c0b96341be612214928f63f2413fe28ba07ca972d79ae34b3c6eb3efa9732fa828f1bcdcc37720d92165a533a375c75eca6779f786970f65af239
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9sP0:5SeOQdaZNxtk8cqhSxvHY9s
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
- Launch Daemon
  Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence

© 2018-2024

Terms | Privacy