evilquest | bbe624417e7cab2fd2cbe00f0601d3853d5e6187601aeddc9f77b21bb54acd1b

General

Target

2024-12-24_02388720d102548b023d195257a77672_adload_evilquest_rekoobe
Size

168KB
MD5

02388720d102548b023d195257a77672
SHA1

eef6713249b2577f884e5805a2bfcfa2acd5144a
SHA256

bbe624417e7cab2fd2cbe00f0601d3853d5e6187601aeddc9f77b21bb54acd1b
SHA512

7042e03b476b283ec3cdfaf8e054bf25267e53007829603a1fbf956fb969b1d71d976a58d94b2beacf11faaccb02e901fcd91115e651aae254338afaed1581a9
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9jx0:5SeOQdaZNxtk8cqhSxvHY9

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 2 IoCs

resource	yara_rule
behavioral1/files/0x000000030008bf65-0.dat	family_evilquest
behavioral1/files/0x000000030008bf67-1.dat	family_evilquest

Evilquest family
evilquest
Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 10 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Launchctl 1 TTPs 20 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-24_02388720d102548b023d195257a77672_adload_evilquest_rekoobe\""
1⤵
PID:462

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-12-24_02388720d102548b023d195257a77672_adload_evilquest_rekoobe\""
1⤵
PID:462

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-12-24_02388720d102548b023d195257a77672_adload_evilquest_rekoobe
1⤵
PID:462
- /bin/zsh
  /bin/zsh -c /Users/run/2024-12-24_02388720d102548b023d195257a77672_adload_evilquest_rekoobe
  2⤵
  PID:464
- /Users/run/2024-12-24_02388720d102548b023d195257a77672_adload_evilquest_rekoobe
  /Users/run/2024-12-24_02388720d102548b023d195257a77672_adload_evilquest_rekoobe
  2⤵
  PID:464

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:465

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:465

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:465

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:491

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:491

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:492

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:492

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:493

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:493

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:493

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:494

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:494

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:495

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:495

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:495

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:496

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:496

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:496

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:498

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:498

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:498

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:499

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:499

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:499

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:500

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:500

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:500

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:501

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:501

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:501

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:502

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:502

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:502

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:503

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:503

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:503

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:508

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:508

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:510

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:510

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:511

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:511

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:513

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:513

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:514

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:514

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:517

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:517

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:518

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:518

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:520

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:520

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:521

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:522

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:522

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:523

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:523

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:524

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:524

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:525

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:525

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:528

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:528

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:529

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:529

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:530

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:530

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:531

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:531

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:532

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:532

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:533

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:533

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:534

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:534

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:535

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:535

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:536

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:536

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:537

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:537

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:538

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:538

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:539

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:539

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:540

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:540

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:541

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:541

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:542

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:542

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:543

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:543

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:543

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

AppleScript

1

T1059.002

System Services

1

T1569

Launchctl

1

T1569.001

Persistence

Create or Modify System Process

2

T1543

Launch Agent

1

T1543.001

Launch Daemon

1

T1543.004

Privilege Escalation

Create or Modify System Process

2

T1543

Launch Agent

1

T1543.001

Launch Daemon

1

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
de6cda8a2c215ba93b2b2f55f2890b8c

SHA1
bb724b5a3249c15df1e2ce4818588eb1cf18cb7e

SHA256
b17f4cc271d24fd967290d41036dcc5375669bcbb61a31178e679fe511dac277

SHA512
0f35a576bf16b29a3f116e4d33caf5c330b0ec18aeaca79aa7f26bc3e7cfbbbdbc78408e4d99bd5c6ba119f6901934d4bc4f5630f7c1149f35e630acfc4a467c

Download Submit
/Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
430B

MD5
3d269391b44f568c96f9f5a420609082

SHA1
e2d49405da7ba6f883b366f71b6905b6ab556cae

SHA256
261e6af4aec0840afe0b4c75c21353d7bc8d69ffb1d26db364f5475962381a12

SHA512
81ae24faac0d2973a90b7ec7415273f95789fbbdeae164df6ffab10bfdfc4896d6ecf4d9b09ca13b2a151a385c59f48594d7b3d0df3b49e3bbc056f15908432c

Download Submit
/Users/run/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c754d124df5ce8ddc63fcec74d7bedde

SHA1
f4aab7e4fc93c84f91f1ff121bbb61b8a7fcf8b2

SHA256
98cfd58b9264c9679841301c50587b427cfb977a741d1e0e6a1f6c24670960c8

SHA512
945fa9d9066ee6a4b462b0f2b10d05c45e47611e5597c2ae6a63becfa1ba9135ed3d91137ffdadf2eff83b1426380e6a7676beb1e885d811b4a9c321dfe732a7

Download Submit

Analysis

Sharing