# OSX.EvilQuest macOS malware doubles as file infector

Published: 2020-07-03 · Severity: medium
Canonical: https://vorant.io/reports/bec322b2-a4b3-5737-a64a-09102a71c3a8/osx-evilquest-macos-malware-doubles-as-file-infector

> Deep analysis reveals OSX.EvilQuest is a true self-replicating macOS virus combining ransomware, keylogging, remote tasking, and credential/wallet theft.

Objective-See's follow-up analysis of OSX.EvilQuest shows the macOS malware is far more than commodity ransomware. It contains genuine viral infection logic — recursively scanning user directories, prepending itself to legitimate executable Mach-O binaries, and restoring the original binary's bytes from an appended trailer so infections remain unnoticed while propagating locally. This self-replicating behavior means simple removal of the malware's launch items is insufficient; the authors recommend a full OS reinstall for infected hosts.

Beyond infection, EvilQuest runs a forensic-exfiltration thread that harvests directory listings and searches for sensitive files (SSH keys, certificates, .pem/.p12/.pfx files, and cryptocurrency wallet images) under 7KB, sending matches to a remote C2 server resolved via a hardcoded pythonanywhere.com dropper page or a fallback hardcoded IP. The malware supports a compact remote tasking protocol allowing in-memory payload execution, file drop/execute, keylogging via CGEventTap, arbitrary shell command execution via popen, and includes a kqueue-based self-healing persistence mechanism that automatically restores its on-disk binary and LaunchDaemon/LaunchAgent artifacts if tampered with.

The ransomware component encrypts a broad list of file extensions after a delay, dropping a ransom note (READ_ME_NOW.txt) and using macOS's 'say' command to read it aloud. Notably, researchers found the malware contains a decryption routine (uncarve_target) that is never actually called, and the generated encryption key is never transmitted to the C2 server — strongly suggesting that victims who pay have no functional path to recovering their files. Objective-See's free tools BlockBlock and RansomWhere? reportedly detected and blocked key stages of the attack without prior signature knowledge.

## Mentioned in this report

- Malware: OSX.EvilQuest

Source reporting: https://objective-see.org/blog/blog_0x60.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bec322b2-a4b3-5737-a64a-09102a71c3a8/osx-evilquest-macos-malware-doubles-as-file-infector.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup