evilquest | d57abb0dcb9cf1a2a5a92303f8644a28681bff6a86b3e5d1ebc17dc66655ba69 | Triage

Submit
Reports

Overview

overview

Static

static

2024092957...ekoobe

macos-10.15-amd64

Sharing

General

Target

2024092957d29110ef89127a3ea71d153b14b72fadloadevilquestrekoobe
Size

177KB
Sample

240929-shtm1asdrd
MD5

57d29110ef89127a3ea71d153b14b72f
SHA1

905ac95d9dcb526136fb43bf61170b7f4fd19266
SHA256

d57abb0dcb9cf1a2a5a92303f8644a28681bff6a86b3e5d1ebc17dc66655ba69
SHA512

0c598ba0f23f7646d867e473a7f119ddc71eebe10ef154e7243c5c9224946b79b2b95b9f67f917721ca6565454dd51c76759823b077ea8a0962224665a7251fc
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9N0k:5SeOQdaZNxtk8cqhSxvHY9r

Score

10^/10

evilquest backdoor evasion execution macos persistence

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

2024092957d29110ef89127a3ea71d153b14b72fadloadevilquestrekoobe

Resource

macos-20240711.1-en

evilquest backdoor evasion execution persistence

macos-10.15-amd64

7 signatures

150 seconds

Malware Config

Targets

- Target
  
  2024092957d29110ef89127a3ea71d153b14b72fadloadevilquestrekoobe
- Size
  
  177KB
- MD5
  
  57d29110ef89127a3ea71d153b14b72f
- SHA1
  
  905ac95d9dcb526136fb43bf61170b7f4fd19266
- SHA256
  
  d57abb0dcb9cf1a2a5a92303f8644a28681bff6a86b3e5d1ebc17dc66655ba69
- SHA512
  
  0c598ba0f23f7646d867e473a7f119ddc71eebe10ef154e7243c5c9224946b79b2b95b9f67f917721ca6565454dd51c76759823b077ea8a0962224665a7251fc
- SSDEEP
  
  3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9N0k:5SeOQdaZNxtk8cqhSxvHY9r
Score

10^/10

evilquest backdoor evasion execution persistence
- EvilQuest
  EvilQuest family.
  backdoor evilquest
- EvilQuest payload
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
- Launch Daemon
  Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Launch Daemon

Privilege Escalation

Create or Modify System Process

Launch Agent

Launch Daemon

Defense Evasion

Hide Artifacts

Resource Forking

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

evilquestbackdoorevasionexecutionpersistence

© 2018-2024

Terms | Privacy