f9a142ab74828c5a0152e27b1e52c5eced2ebb6386adba0131e86bb0988bfa82

General

Target
2026-07-29_5d83e8626b2149475316983dc459fcfc_adload_evilquest_rekoobe
Size 168KB
Sample260730-cbacsazzev
SHA256 f9a142ab74828c5a0152e27b1e52c5eced2ebb6386adba0131e86bb0988bfa82
MD5 5d83e8626b2149475316983dc459fcfc
SHA1 9d698e9c9792ee2d7689b8f6e497f89f682b50bd
SHA512 d36a29946f35afab40fc27b394162d16c20f7a5e7c0ca54879fe9428080bbb2fe0beaf3a08888ef8357f34f9ee4107519c4afc1e77bb063b9ebd367545ff637a
SSDEEP 3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9nFI0:5SeOQdaZNxtk8cqhSxvHY9nF
TLSH
T161F393B35260D859C19FC4F036D98AF26D1078350BB4715E2BE14E7B6FB6CC056AE38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

defense_evasion execution persistence

Malware Config

Signatures

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found

Launchctl 1 TTPs 4 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2026-07-29_5d83e8626b2149475316983dc459fcfc_adload_evilquest_rekoobe\""
1⤵
PID:460

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2026-07-29_5d83e8626b2149475316983dc459fcfc_adload_evilquest_rekoobe\""
1⤵
PID:460

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2026-07-29_5d83e8626b2149475316983dc459fcfc_adload_evilquest_rekoobe
1⤵
PID:460
- /bin/zsh
  /bin/zsh -c /Users/run/2026-07-29_5d83e8626b2149475316983dc459fcfc_adload_evilquest_rekoobe
  2⤵
  PID:463
- /Users/run/2026-07-29_5d83e8626b2149475316983dc459fcfc_adload_evilquest_rekoobe
  /Users/run/2026-07-29_5d83e8626b2149475316983dc459fcfc_adload_evilquest_rekoobe
  2⤵
  PID:463

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:451

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:454

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:448

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:446

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:464

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:464

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:464

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:456

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:487

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:487

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:487

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:488

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:488

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:489

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:489

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:489

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:490

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:490

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:491

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:491

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:492

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:492

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:493

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:493

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:493

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:498

/Users/run/Library/osxmobiledata/com.apple.afsvcpd
/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:498

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:499

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:499

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:499

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:501

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:501

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 197
1⤵
PID:502

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:502