OSX.EvilQuest ransomware spreads via pirated Mac apps

29 June 2020 routine threat

A new macOS ransomware, OSX.EvilQuest, is bundled in trojanized pirated software on torrent sites and combines encryption with anti-analysis, keylogging and persistence features.

Researchers identified a new macOS ransomware family, dubbed OSX.EvilQuest, being distributed inside trojanized installers for pirated software (observed in a fake 'Mixed In Key 8' DMG). The malicious postinstall script drops an unsigned Mach-O binary ('patch', later renamed 'toolroomd') that requests root during installation and persists itself as a LaunchDaemon/LaunchAgent disguised as an Apple process (com.apple.questd).

Analysis of the binary revealed extensive anti-analysis tradecraft: sandbox/VM detection via sleep-patching checks, anti-debugging via sysctl P_TRACED checks and ptrace(PTRACE_DENY_ATTACH), and string obfuscation/encryption requiring dynamic library injection to decrypt. Beyond file encryption for ransom (demanding ~$50 in Bitcoin with a 72-hour deadline), the sample contains capabilities well beyond typical ransomware, including keylogging (CGEventTap APIs), host/process reconnaissance, in-memory code execution, and logic to search for and exfiltrate sensitive files such as SSH keys, certificates, and cryptocurrency wallet images. It also attempts to kill security tools including Little Snitch, Kaspersky, Norton, Avast, DrWeb, McAfee, Bitdefender and BullGuard before persisting.

Decrypted strings exposed a hardcoded C2 domain and IP address. At time of analysis the malicious DMG and payload were undetected by VirusTotal AV engines, though detection was expected to improve. The infection vector — pirated software shared via torrents — is unsophisticated but has proven a persistently effective distribution method for macOS malware such as OSX/Shlayer.

Mentioned in this report

Malware OSX.EvilQuest

Detection guidance

Unsigned Mach-O Binary Requesting Root via Postinstall Script

ATT&CK T1204.002

Postinstall script from DMG/package drops unsigned binary and requests elevated privileges - typical trojanized app distribution vector. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Unsigned Mach-O Binary Requesting Root via Postinstall Script
description: Detects postinstall scripts dropping unsigned Mach-O binaries and requesting
  root privileges. Generalises on the parent/child process relation and privilege
  escalation pattern typical of trojanized software installers.
tags:
- attack.execution
- attack.t1204.002
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    ParentImage|contains: postinstall
    Image|endswith:
    - /usr/bin/sudo
    - /bin/sudo
    CommandLine|contains:
    - sudo
    - -u root
  filter_package_management:
    CommandLine|contains:
    - /Library/Updates
    - com.apple.SoftwareUpdate
    - InstallAssistant
  condition: selection and not filter_package_management
falsepositives:
- Legitimate software installers that require root for system extensions
- Official macOS updates and patches using postinstall scripts
level: high
id: c69806c0-a115-5ce7-825e-f002d5803021
status: experimental
author: Vorant

LaunchDaemon Registration with Apple-Spoofed Bundle Identifier

ATT&CK T1543.004

Unsigned binary persists as LaunchDaemon/LaunchAgent with spoofed Apple bundle ID (com.apple.* pattern) - typical ransomware persistence masquerading. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: LaunchDaemon Registration with Apple-Spoofed Bundle Identifier
description: Detects creation of LaunchDaemon or LaunchAgent plist files with bundle
  identifiers spoofing Apple services (com.apple.*). Unsigned Mach-O binaries registering
  as Apple daemons is uncommon and indicative of persistence abuse.
tags:
- attack.persistence
- attack.t1543.004
logsource:
  category: file_event
  product: macos
detection:
  selection:
    TargetFilename|contains:
    - /Library/LaunchDaemons/
    - /Library/LaunchAgents/
    TargetFilename|endswith: .plist
  selection_content:
    FileContent|contains: com.apple.
  filter_apple_official:
    TargetFilename|contains:
    - /System/Library/LaunchDaemons/com.apple.
    - /System/Library/LaunchAgents/com.apple.
  condition: selection and selection_content and not filter_apple_official
falsepositives:
- Third-party apps bundling legitimate Apple-prefixed helper services
- MDM or enterprise management tools registering helper daemons
level: high
id: 951063ac-d051-5c0e-8e0a-510ebfbc0c97
status: experimental
author: Vorant

Process Discovery and Security Tool Termination Pattern

ATT&CK T1057

Binary enumerates processes and terminates known security tools (Little Snitch, Kaspersky, Norton, Avast, etc.) before encryption - ransomware defense evasion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Process Discovery and Security Tool Termination Pattern
description: Detects processes enumerating running processes and terminating known
  macOS security tools. Ransomware typically kills security products before encrypting
  files.
tags:
- attack.defense-evasion
- attack.t1057
- attack.t1562.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_discovery:
    CommandLine|contains:
    - ps aux
    - ps -ef
    - lsof
    - launchctl list
  selection_kill:
    CommandLine|contains:
    - kill
    - killall
  selection_targets:
    CommandLine|contains:
    - Little Snitch
    - Kaspersky
    - Norton
    - Avast
    - DrWeb
    - McAfee
    - Bitdefender
    - BullGuard
  condition: (selection_discovery or selection_kill) and selection_targets
falsepositives:
- System administration scripts managing antivirus or security product updates
- IT automation during authorized security tool deployment or uninstall
level: high
id: d6be8f3c-0406-5a59-b9c5-ce68bb470be9
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x59.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free