d76f86a80a86dd903347797e366c2ae75bcc00016913fc17f248cbb1193bcbda

General

Target

2024-12-23_7e428ba0e4c8460e038ceb0439b63c69_adload_evilquest_rekoobe
Size

168KB
MD5

7e428ba0e4c8460e038ceb0439b63c69
SHA1

3d0f28d02d5be5744fda5a43bb6a382ae9fafe3d
SHA256

d76f86a80a86dd903347797e366c2ae75bcc00016913fc17f248cbb1193bcbda
SHA512

418332ae3aa978f87ed77fd9084e0e0f105c285dcec49b0e735cf64fefaff9e32cce6d62e0b81f1d679fbe25f5e7092aa9d9ddba898c16622a26c3bcc6ad8d71
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9R0:5SeOQdaZNxtk8cqhSxvHY9

Score

5^/10

evasion execution persistence

Malware Config

Signatures

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 4 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found

Launchctl 1 TTPs 8 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-23_7e428ba0e4c8460e038ceb0439b63c69_adload_evilquest_rekoobe\""
1⤵
PID:457

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-23_7e428ba0e4c8460e038ceb0439b63c69_adload_evilquest_rekoobe\""
1⤵
PID:457

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-12-23_7e428ba0e4c8460e038ceb0439b63c69_adload_evilquest_rekoobe
1⤵
PID:457
- /bin/zsh
  /bin/zsh -c /Users/run/2024-12-23_7e428ba0e4c8460e038ceb0439b63c69_adload_evilquest_rekoobe
  2⤵
  PID:459
- /Users/run/2024-12-23_7e428ba0e4c8460e038ceb0439b63c69_adload_evilquest_rekoobe
  /Users/run/2024-12-23_7e428ba0e4c8460e038ceb0439b63c69_adload_evilquest_rekoobe
  2⤵
  PID:459

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:448

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:451

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:445

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:443

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:454

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:460

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:460

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:460

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:484

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:484

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:484

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:485

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:485

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:486

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:486

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:486

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:487

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:487

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:488

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:488

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:488

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:489

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:489

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:489

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:490

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:490

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:490

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:498

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:498

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:499

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:499

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:500

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:500

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:501

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:501

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:502

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:502

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:502

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:506

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:506

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:507

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:507

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:507

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:508

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:508

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:509

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:509

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:511

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:511

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:512

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:512

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:513

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:513

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:514

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:514

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:517

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:517

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:518

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:518

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:519

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:519

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:520

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:520

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:521

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:521

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:522

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:522

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:523

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:523

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:524

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:524

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:525

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:525

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:526

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:526

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:527

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:527

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:528

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:528

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:529

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:529

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:530

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:530

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:531

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:531

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:532

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:532

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

AppleScript

1

T1059.002

System Services

1

T1569

Launchctl

1

T1569.001

Persistence

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Privilege Escalation

Create or Modify System Process

1

T1543

Launch Agent

1

T1543.001

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/var/db/nsurlstoraged/dafsaData.bin

Filesize
54KB

MD5
64f469698e53d0c828b7f90acd306082

SHA1
bcc041b3849e1b0b4104ffeb46002207eeac54f3

SHA256
d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

SHA512
a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

Download Submit

Analysis

Sharing