Overview

overview

10

Static

static

10

f409b05920...f41794

macos-10.15-amd64

10

Resubmissions

13/06/2026, 16:54

260613-veljbsgw6w10

08/06/2026, 13:58

260608-q9xsmafs8s10

07/06/2026, 14:06

260607-rese4afw5q10

22/05/2026, 10:56

260522-m13qqshs9k10

21/05/2026, 15:14

260521-smk7esbv5110

06/04/2026, 08:19

260406-j8as5sgz2s10

24/02/2026, 14:25

260224-rq9hraat7g10

15/02/2026, 19:18

260215-xz94jaaz3b10

12/02/2026, 15:40

260212-s4nnwaas8a10

21/01/2026, 05:45

260121-gf2p2sg19f10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ransom.macho_24020662402.zip
  • Size 43KB
  • Sample260121-gf2p2sg19f
  • SHA256 8f013aed67e8ac812c67e4fcc322fa876e33f8b75c2472013817e41e161ee5d0
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
evilquestbackdoordefense_evasionexecutionmacospersistenceransomware

Malware Config

Extracted

Path

  • /Users/run/Desktop/READ_ME_NOW.txt

Ransom Note
  • YOUR IMPORTANT FILES ARE ENCRYPTED Many of your documents, photos, videos, images and other files are no longer accessible because they have been encrypted. Maybe you are busy looking for a way to recover your files, but do not waste your time. Nobody can recover your file without our decryption service. We use 256-bit AES algorithm so it will take you more than a billion years to break this encryption without knowing the key (you can read Wikipedia about AES if you don't believe this statement). Anyways, we guarantee that you can recover your files safely and easily. This will require us to use some processing power, electricity and storage on our side, so there's a fixed processing fee of 50 USD. This is a one-time payment, no additional fees included. In order to accept this offer, you have to deposit payment within 72 hours (3 days) after receiving this message, otherwise this offer will expire and you will lose your files forever. Payment has to be deposited in Bitcoin based on Bitcoin/USD exchange rate at the moment of payment. The address you have to make payment is: 13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7 Decryption will start automatically within 2 hours after the payment has been processed and will take from 2 to 5 hours depending on the processing power of your computer. After that all of your files will be restored. THIS OFFER IS VALID FOR 72 HOURS AFTER RECEIVING THIS MESSAGE
Wallets

  • 13roGMpWd7Pb3ZoJyce8eoQpfegQvGHHK7

Targets

    • Target
      f409b059205d9a7700d45022dad179f889f18c58c7a284673975271f6af41794
    • Size 96KB
    • SHA256 f409b059205d9a7700d45022dad179f889f18c58c7a284673975271f6af41794
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    backdoordefense_evasionexecutionevilquestpersistenceransomware

    • EvilQuest

      EvilQuest family.

      backdoorevilquest

    • EvilQuest payload

    • Evilquest family

      evilquest

    • Compromise Client Software Binary

      Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server.

      persistence

    • Launch Daemon

      Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.

      persistence
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks