evilquest | cdf2a11bfae2af36ca36fb8e6c1c08798089b4bc40aa5c5c5d57f1c4050940da | Triage™

Login
Reports

Overview

overview

Static

static

2026-10-31...ekoobe

macos-10.15-amd64

Sharing

Copy URL Twitter E-mail

General

Target
2026-10-31_40a31bce5bc6caddaff6f5568ef103b8_adload_evilquest_rekoobe
Size 168KB
Sample261031-sdmnwsxyby
SHA256 cdf2a11bfae2af36ca36fb8e6c1c08798089b4bc40aa5c5c5d57f1c4050940da
MD5 40a31bce5bc6caddaff6f5568ef103b8
SHA1 fd253bdb53ff8c69b9eb1457b38a100ef9a3587b
SHA512 f1529e380ecf31bf6306531101d0d50adf2abf26d796b8c4f53f661f0e34e7aed8be1de9edbd32ac40be181a0d4cc44b3b4f79e5a23bb283b819ef0f7078b3a6
SSDEEP 3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9YZc0:5SeOQdaZNxtk8cqhSxvHY9
TLSH
T1FFF3B3B31260D46AC05FC4F136D98AF26D4078354BB4715E2BE14E7B6FB6CC056AE38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

evilquest backdoor execution macos persistence

Static task

static1

2 signatures

backdoor evilquest

Behavioral task

behavioral1

Sample

2026-10-31_40a31bce5bc6caddaff6f5568ef103b8_adload_evilquest_rekoobe

Resource

macos-20260915-en

macos-10.15-amd64

5 signatures

150 seconds

backdoor execution evilquest persistence

Malware Config

Targets

- Target
  2026-10-31_40a31bce5bc6caddaff6f5568ef103b8_adload_evilquest_rekoobe
- Size 168KB
- SHA256 cdf2a11bfae2af36ca36fb8e6c1c08798089b4bc40aa5c5c5d57f1c4050940da
- MD5 40a31bce5bc6caddaff6f5568ef103b8
- SHA1 fd253bdb53ff8c69b9eb1457b38a100ef9a3587b
- SHA512 f1529e380ecf31bf6306531101d0d50adf2abf26d796b8c4f53f661f0e34e7aed8be1de9edbd32ac40be181a0d4cc44b3b4f79e5a23bb283b819ef0f7078b3a6
- SSDEEP 3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9YZc0:5SeOQdaZNxtk8cqhSxvHY9
- TLSH
  T1FFF3B3B31260D46AC05FC4F136D98AF26D4078354BB4715E2BE14E7B6FB6CC056AE38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor execution evilquest persistence
- EvilQuest payload
- Family: EvilQuest
  EvilQuest family.
  backdoor evilquest
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Privilege Escalation

Create or Modify System Process

Launch Agent

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

backdoorevilquest

behavioral1

backdoorexecutionevilquestpersistence

© 2018-2026

Terms | Privacy