OSX.EvilQuest ransomware spreads via pirated Mac apps
A new macOS ransomware, OSX.EvilQuest, is bundled in trojanized pirated software on torrent sites and combines encryption with anti-analysis, keylogging and persistence features.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Researchers identified a new macOS ransomware family, dubbed OSX.EvilQuest, being distributed inside trojanized installers for pirated software (observed in a fake 'Mixed In Key 8' DMG). The malicious postinstall script drops an unsigned Mach-O binary ('patch', later renamed 'toolroomd') that requests root during installation and persists itself as a LaunchDaemon/LaunchAgent disguised as an Apple process (com.apple.questd).
Analysis of the binary revealed extensive anti-analysis tradecraft: sandbox/VM detection via sleep-patching checks, anti-debugging via sysctl P_TRACED checks and ptrace(PTRACE_DENY_ATTACH), and string obfuscation/encryption requiring dynamic library injection to decrypt. Beyond file encryption for ransom (demanding ~$50 in Bitcoin with a 72-hour deadline), the sample contains capabilities well beyond typical ransomware, including keylogging (CGEventTap APIs), host/process reconnaissance, in-memory code execution, and logic to search for and exfiltrate sensitive files such as SSH keys, certificates, and cryptocurrency wallet images. It also attempts to kill security tools including Little Snitch, Kaspersky, Norton, Avast, DrWeb, McAfee, Bitdefender and BullGuard before persisting.
Decrypted strings exposed a hardcoded C2 domain and IP address. At time of analysis the malicious DMG and payload were undetected by VirusTotal AV engines, though detection was expected to improve. The infection vector — pirated software shared via torrents — is unsophisticated but has proven a persistently effective distribution method for macOS malware such as OSX/Shlayer.
Mentioned in this report
Detection guidance
Unsigned Mach-O Binary Requesting Root via Postinstall Script
A behavioural hunt for the technique in general.
Postinstall script from DMG/package drops unsigned binary and requests elevated privileges - typical trojanized app distribution vector. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Unsigned Mach-O Binary Requesting Root via Postinstall Script
description: Detects postinstall scripts dropping unsigned Mach-O binaries and requesting
root privileges. Generalises on the parent/child process relation and privilege
escalation pattern typical of trojanized software installers.
tags:
- attack.execution
- attack.t1204.002
logsource:
category: process_creation
product: macos
detection:
selection:
ParentImage|contains: postinstall
Image|endswith:
- /usr/bin/sudo
- /bin/sudo
CommandLine|contains:
- sudo
- -u root
filter_package_management:
CommandLine|contains:
- /Library/Updates
- com.apple.SoftwareUpdate
- InstallAssistant
condition: selection and not filter_package_management
falsepositives:
- Legitimate software installers that require root for system extensions
- Official macOS updates and patches using postinstall scripts
level: high
id: c69806c0-a115-5ce7-825e-f002d5803021
status: experimental
author: Vorant
Process Discovery and Security Tool Termination Pattern
A behavioural hunt for the technique in general.
Binary enumerates processes and terminates known security tools (Little Snitch, Kaspersky, Norton, Avast, etc.) before encryption - ransomware defense evasion. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Discovery and Security Tool Termination Pattern
description: Detects processes enumerating running processes and terminating known
macOS security tools. Ransomware typically kills security products before encrypting
files.
tags:
- attack.defense-impairment
- attack.t1057
- attack.t1685
logsource:
category: process_creation
product: macos
detection:
selection_discovery:
CommandLine|contains:
- ps aux
- ps -ef
- lsof
- launchctl list
selection_kill:
CommandLine|contains:
- kill
- killall
selection_targets:
CommandLine|contains:
- Little Snitch
- Kaspersky
- Norton
- Avast
- DrWeb
- McAfee
- Bitdefender
- BullGuard
condition: (selection_discovery or selection_kill) and selection_targets
falsepositives:
- System administration scripts managing antivirus or security product updates
- IT automation during authorized security tool deployment or uninstall
level: high
id: d6be8f3c-0406-5a59-b9c5-ce68bb470be9
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x59.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs