OSX.EvilQuest Uncovered
Excerpt
part ii: insidious capabilities
by: Patrick Wardle / July 3, 2020
Our research, tools, and writing, are supported by the "Friends of Objective-See" such as:
📝 👾 Want to play along?
I’ve added the sample (‘OSX.EvilQuest’) to our malware collection (password: infect3d)
…please don’t infect yourself!
Background
In part one of this blog post series, we detailed the infection vector, persistence, and anti-analysis logic of OSX.EvilQuest .
Though initially though to be a rather mundane piece of ransomware, further analysis revealed something far more powerful and insidious. In this post, we detail the malware’s viral actions, as well as detail its full capabilities (ransomware logic included).
Vira…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by objective-see.com on objective-see.com.
On the same topics
- Ragnar LoaderPRODAFT · Added 18 Oct
- Netwalker malware: What it is, how it works and how to prevent itInfosec Institute · Published 29 Jul 2020
- How CrowdStrike Analyzes macOS Malware to Optimize Automated DetectionCrowdStrike · Published 6 May 2022
- Disrupting Fox Tempest: A cybercrime service that turned “verified” software into a pathway for ransomwareMicrosoft · Published 19 May
