evilquest | 33c23f4f730dfc2eb278fab2852353e8f54354e2f7f9df305a28f458d2113498 | Triage

Sharing

General

Target

08fd804e00609e1d74f04e6a90be5dc4_JaffaCakes118
Size

168KB
Sample

240430-erx5wsbh64
MD5

08fd804e00609e1d74f04e6a90be5dc4
SHA1

65ffd8844947e77459da37ae228dc7aec59f05ff
SHA256

33c23f4f730dfc2eb278fab2852353e8f54354e2f7f9df305a28f458d2113498
SHA512

14b9c05df6f4eb9df625c4878e357730487732cdb56a6de8e91615adf5830bef2e1f355bc30d675b1a5155fb05a5599659e0e1ad4db1de7e320af7ab94806bd9
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq96Mn0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest execution macos persistence

Malware Config

Targets

- Target
  
  08fd804e00609e1d74f04e6a90be5dc4_JaffaCakes118
- Size
  
  168KB
- MD5
  
  08fd804e00609e1d74f04e6a90be5dc4
- SHA1
  
  65ffd8844947e77459da37ae228dc7aec59f05ff
- SHA256
  
  33c23f4f730dfc2eb278fab2852353e8f54354e2f7f9df305a28f458d2113498
- SHA512
  
  14b9c05df6f4eb9df625c4878e357730487732cdb56a6de8e91615adf5830bef2e1f355bc30d675b1a5155fb05a5599659e0e1ad4db1de7e320af7ab94806bd9
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq96Mn0:5SeOQdaZNxtk8cqhSxvHY9
Score

5^/10

execution persistence
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Privilege Escalation

Create or Modify System Process

Launch Agent

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

executionpersistence