evilquest | 4d1b9bcfde0d7efa94f6d9c48bddf8be3730a2ffeaef4b7c70d81c0ad2aac6a0 | Triage

Submit
Reports

Overview

overview

Static

static

072bea34ba...kes118

macos-10.15-amd64

Sharing

General

Target

072bea34bac649e05c825fce9a6b3a02_JaffaCakes118
Size

168KB
Sample

240429-jq1a3seb6x
MD5

072bea34bac649e05c825fce9a6b3a02
SHA1

9ec1cd64c5ddcc0d818975392c3a08eb45548990
SHA256

4d1b9bcfde0d7efa94f6d9c48bddf8be3730a2ffeaef4b7c70d81c0ad2aac6a0
SHA512

b2504057fee736a7842f46597ef53f0107d7cc888582f2e6df08dc838fb2d602faeb01383e8e57e0012ef9cb412b8ed99797b2c0b0d5c752736bdc5de6456fbb
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9I0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor evasion execution macos persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

072bea34bac649e05c825fce9a6b3a02_JaffaCakes118

Resource

macos-20240410-en

evilquest backdoor evasion execution persistence

macos-10.15-amd64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  072bea34bac649e05c825fce9a6b3a02_JaffaCakes118
- Size
  
  168KB
- MD5
  
  072bea34bac649e05c825fce9a6b3a02
- SHA1
  
  9ec1cd64c5ddcc0d818975392c3a08eb45548990
- SHA256
  
  4d1b9bcfde0d7efa94f6d9c48bddf8be3730a2ffeaef4b7c70d81c0ad2aac6a0
- SHA512
  
  b2504057fee736a7842f46597ef53f0107d7cc888582f2e6df08dc838fb2d602faeb01383e8e57e0012ef9cb412b8ed99797b2c0b0d5c752736bdc5de6456fbb
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9I0:5SeOQdaZNxtk8cqhSxvHY9
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
- Launch Daemon
  Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence

© 2018-2024

Terms | Privacy