evilquest | 60570d32fdbf4cc607ad91c4842ae99f5b628fd1a7fdf48b6b11e6fdef3d20b5 | Triage

Sharing

General

Target

05f4f08c0ff2333f04a3e339243fe776_JaffaCakes118
Size

168KB
Sample

240428-yql6sagb3y
MD5

05f4f08c0ff2333f04a3e339243fe776
SHA1

cd4470d63d68a738bf96046274a7fc5a9d64e8d0
SHA256

60570d32fdbf4cc607ad91c4842ae99f5b628fd1a7fdf48b6b11e6fdef3d20b5
SHA512

664d2216e2f761689eba094a2f67142179d3f9cac0c6371d54306ffad79c1d9721cca386be39bda0449a4fc86ded0cae27612d172971b30c1d3715b6dd309c9b
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9290:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest execution macos persistence

Malware Config

Targets

- Target
  
  05f4f08c0ff2333f04a3e339243fe776_JaffaCakes118
- Size
  
  168KB
- MD5
  
  05f4f08c0ff2333f04a3e339243fe776
- SHA1
  
  cd4470d63d68a738bf96046274a7fc5a9d64e8d0
- SHA256
  
  60570d32fdbf4cc607ad91c4842ae99f5b628fd1a7fdf48b6b11e6fdef3d20b5
- SHA512
  
  664d2216e2f761689eba094a2f67142179d3f9cac0c6371d54306ffad79c1d9721cca386be39bda0449a4fc86ded0cae27612d172971b30c1d3715b6dd309c9b
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9290:5SeOQdaZNxtk8cqhSxvHY9
Score

5^/10

execution persistence
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Privilege Escalation

Create or Modify System Process

Launch Agent

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistence