TF-MAL-osx.evilquest
📛 Threat Title
Malware family: EvilQuest
Description
ThreatFox malware family `osx.evilquest`. Printable name: EvilQuest. Aliases: ThiefQuest.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
osx.evilquest
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.evilquest
IOC database
- Type
- domain
- Value
osx.evilquest- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-osx.evilquest
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/osx.evilquest
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:amr-git-dot.github.io
EvilQuest macOS Ransomware 8 minute read On this page Mac OS Malware Analysis OverView File Structure Header Load Commands: Segmants Code Analysis Args Check Anti-VM Enum user Info Enumerating Privileges Anti-Debugging Persistence Actual capapilities C&C Collecting Host Info Stealing files Encrypting process Resources Mac OS Malware Analysis This won't be just an analysis of the " EvilQuest ...
-
web:attack.mitre.org
OSX. EvilQuest Uncovered part ii: insidious capabilities. Retrieved March 21, 2021. Thomas Reed. (2020, July 7). Mac ThiefQuest malware may not be ransomware after all. Retrieved March 22, 2021. Phil Stokes. (2020, July 8). " EvilQuest " Rolls Ransomware, Spyware & Data Theft Into One. Retrieved April 1, 2021. Patrick Wardle. (2020, June 29).
-
web:lifetips.alibaba.com
The core misconception is treating ransomware as a " malware problem." EvilQuest is a *trust exploitation problem*. It succeeds because users trust Apple's notarization system—and attackers exploit that trust by compromising legitimate developer accounts or repackaging signed apps with malicious launch agents. Therefore, avoidance depends on breaking the chain at the earliest possible ...
-
web:macsecurity.net
In case the above manual removal steps weren't effective enough, proceed to the following section to purge the threat for good. Get rid of EvilQuest ransomware using Combo Cleaner removal tool The Mac maintenance and security app called Combo Cleaner is a one-stop tool to detect and remove EvilQuest virus.
-
web:malpedia.caad.fkie.fraunhofer.de
According to PcRisk, EvilQuest (also known as ThiefQuest) is like many other malicious programs of this type - it encrypts files and creates a ransom message. In most cases, this type of malware modifies the names of encrypted files by appending certain extensions, however, this ransomware leaves them unchanged. It drops the "READ_ME_NOW.txt" in each folder that contains encrypted data and ...
-
web:taomm.org
To circumvent this anti-analysis logic (so the malware can be analyzed in a debugger), we can either modify OSX. EvilQuest's binary and patch out this code, or use a debugger to subvert the malware's execution state in memory.
-
web:www.iru.com
EvilQuest , also known as ThiefQuest, is a ransomware variant that targets macOS systems. EvilQuest also includes some information stealing and data exfiltration features. It is actively being enhanced with new features to avoid detection.
-
web:www.jamf.com
Detecting, Preventing, and Remediating EvilQuest Ransomware Once again, a new ransomware variant attacking macOS systems is in the news, dubbed EvilQuest or ThiefQuest. The fact that it is targeting Macs instead of Windows systems already makes it interesting, but let's dig into what it means for organizations.
-
web:www.malwarebytes.com
Malwarebytes for Mac detects and removes Ransom.OSX. EvilQuest Remediation Malwarebytes for Mac will detect and remove the components of this malware . Download and install the latest version of Malwarebytes for Mac. Click the "Scan Now" button to perform a system scan. If threats are detected during the scan, a count of detected threats is ...
-
web:www.sentinelone.com
A new macOS malware threat is more than it seems. With built-in ransomware, data stealer and spyware capabilities, it is also iterating rapidly.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.