MITRE ATT&CKsoftware (malware)
S0595 ThiefQuest
- Domain
- enterprise
- Platforms
- macOS
- Aliases
- MacRansom.K, EvilQuest
- Version
- 1.2
- Created
- 2021-03-19
Description
ThiefQuest is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. ThiefQuest was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links. Even though ThiefQuest presents itself as ransomware, since the dynamically generated encryption key is never sent to the attacker it may be more appropriately thought of as a form of wiper malware.
Related
Uses · MITRE ATT&CK (18)
- T1685 Disable or Modify Tools technique
- T1622 Debugger Evasion technique
- T1620 Reflective Code Loading technique
- T1071.001 Web Protocols sub-technique
- T1059.002 AppleScript sub-technique
- T1497.003 Time Based Checks sub-technique
- T1564.001 Hidden Files and Directories sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1056.001 Keylogging sub-technique
- T1554 Compromise Host Software Binary technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1543.001 Launch Agent sub-technique
- T1543.004 Launch Daemon sub-technique
- T1486 Data Encrypted for Impact technique
- T1041 Exfiltration Over C2 Channel technique
- T1057 Process Discovery technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
References
- https://objective-see.com/blog/blog_0x60.html wardle evilquest partii
- https://www.sentinelone.com/blog/evilquest-a-new-macos-malware-rolls-ransomware-spyware-and-data-theft-into-one/ SentinelOne EvilQuest Ransomware Spyware 2020
- https://blog.malwarebytes.com/detections/osx-thiefquest/ Reed thiefquest fake ransom
- https://blog.malwarebytes.com/mac/2020/07/mac-thiefquest-malware-may-not-be-ransomware-after-all/ reed thiefquest ransomware analysis