evilquest | b2c5af0e5e1e91aec194ce080b723aac15d3dab8659fc4f7b0bce471c1d1d7cc | Triage™

Login
Reports

Overview

overview

Static

static

2026-11-06...ekoobe

macos-10.15-amd64

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-06_f2a55d47342d0dc26baacb4efce4fbf2_adload_evilquest_rekoobe
Size 168KB
Sample261107-xth3vsfs9n
SHA256 b2c5af0e5e1e91aec194ce080b723aac15d3dab8659fc4f7b0bce471c1d1d7cc
MD5 f2a55d47342d0dc26baacb4efce4fbf2
SHA1 0994d6d03b24a6c7b8f66df186a8e4a92806ef43
SHA512 cac03ee6654f0fa072968cff9a13814096592e871c9cf3b65bd93b432e3eee9ba35d3919f520a4f10d904c8da705ae3c7741766d147913dca1accdc4170fbc9c
SSDEEP 3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9ZXC0:5SeOQdaZNxtk8cqhSxvHY9l
TLSH
T197F3A3F71261D46AC05FC4F036D98AF26D1078390BB0715E2BD54E7A6FB6CC056AE38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

evilquest backdoor execution macos persistence

Static task

static1

2 signatures

backdoor evilquest

Behavioral task

behavioral1

Sample

2026-11-06_f2a55d47342d0dc26baacb4efce4fbf2_adload_evilquest_rekoobe

Resource

macos-20260915-en

macos-10.15-amd64

5 signatures

150 seconds

backdoor execution evilquest persistence

Malware Config

Targets

- Target
  2026-11-06_f2a55d47342d0dc26baacb4efce4fbf2_adload_evilquest_rekoobe
- Size 168KB
- SHA256 b2c5af0e5e1e91aec194ce080b723aac15d3dab8659fc4f7b0bce471c1d1d7cc
- MD5 f2a55d47342d0dc26baacb4efce4fbf2
- SHA1 0994d6d03b24a6c7b8f66df186a8e4a92806ef43
- SHA512 cac03ee6654f0fa072968cff9a13814096592e871c9cf3b65bd93b432e3eee9ba35d3919f520a4f10d904c8da705ae3c7741766d147913dca1accdc4170fbc9c
- SSDEEP 3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9ZXC0:5SeOQdaZNxtk8cqhSxvHY9l
- TLSH
  T197F3A3F71261D46AC05FC4F036D98AF26D1078390BB0715E2BD54E7A6FB6CC056AE38A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

backdoor execution evilquest persistence
- EvilQuest payload
- Family: EvilQuest
  EvilQuest family.
  backdoor evilquest
- Launch Agent
  Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
  persistence
behavioral1

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

AppleScript

System Services

Launchctl

Persistence

Create or Modify System Process

Launch Agent

Privilege Escalation

Create or Modify System Process

Launch Agent

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

backdoorevilquest

behavioral1

backdoorexecutionevilquestpersistence

© 2018-2026

Terms | Privacy