evilquest | 495d562891fa3dd67a15f95c1044945f65a389a85c446a54ec320bc096d79e76 | Triage

Submit
Reports

Overview

overview

Static

static

070c07cfcb...kes118

macos-10.15-amd64

Sharing

General

Target

070c07cfcb26756849502d1bc611f3d2_JaffaCakes118
Size

168KB
Sample

240429-hhj4fsdb5y
MD5

070c07cfcb26756849502d1bc611f3d2
SHA1

8fb41a5ba50add4f83454be3c25017a96e5da148
SHA256

495d562891fa3dd67a15f95c1044945f65a389a85c446a54ec320bc096d79e76
SHA512

f8654f6b9569ab5e864b3a01e8d71a074320df91c7b40b75ad204cead23ac4a0a420eb6a7ebdefa1f4d64833a3c2d686977d42f6c93bef2acc48037db2b8dcb5
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9W0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution macos persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

070c07cfcb26756849502d1bc611f3d2_JaffaCakes118

Resource

macos-20240410-en

evilquest backdoor evasion execution persistence

macos-10.15-amd64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  070c07cfcb26756849502d1bc611f3d2_JaffaCakes118
- Size
  
  168KB
- MD5
  
  070c07cfcb26756849502d1bc611f3d2
- SHA1
  
  8fb41a5ba50add4f83454be3c25017a96e5da148
- SHA256
  
  495d562891fa3dd67a15f95c1044945f65a389a85c446a54ec320bc096d79e76
- SHA512
  
  f8654f6b9569ab5e864b3a01e8d71a074320df91c7b40b75ad204cead23ac4a0a420eb6a7ebdefa1f4d64833a3c2d686977d42f6c93bef2acc48037db2b8dcb5
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9W0:5SeOQdaZNxtk8cqhSxvHY9
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
- Launch Daemon
  Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence

© 2018-2024

Terms | Privacy