Rewterz Threat Alert – EvilQuest Wiper Uses Ransomware Cover to Steal Files From Macs

Severity

High

Analysis Summary

Impersonating as Google Software Update program, EvilQuest wiper is found targeting MacOS, with almost zero detection. This new piece of macOS ransomware was found in pirated versions of popular macOS software, shared on popular torrent sites. This method of infection is common and at least at some level successful. It encrypts files and leaves a ransom note. 

The .txt files when opened, looks like this:

It appears to handle tasking from a command and control server (andrewka6.pythonanywhere[.]com). Such tasking includes: 

• executing command 
• starting the keylogger 
• executing a module directly out of memory

Armed with these capabilities, the attacker can gain full control over an infected host!

Impact

• Files Encryption
• Remote code execution
• Credential theft
• Information theft
• System compromise

Indicators of Compromise

Domain Name

• andrewka6[.]pythonanywhere[.]com

MD5

• 777424b278bc6bb4edcecb82dfbcb37d
• 17bfc2fc9dce7254fea0bb86c085c52b
• 9291a3ec715f82ac2ef1545b64e1e51c
• b836f7795e946f8e61185e844151c905
• a2539ab3e8a30bd4b19b0614b5da04ce
• aba3b585dd22d0e1d65ed87fe349b7e1
• 0e1c274aa0f487d6262e5d2bb4830229
• a22e2da6f3ec7f9ddf5f3f8bb8325aeb
• d2d4c05889be06d1772b19f6ddbfc9f6
• a8440c256c6dc84f93a71b31412c6a9e
• 295c6945ef3b9cad6ff37c5510b14627
• eeebec8b56565a7758f4dbd00ddf4180
• 569b651ec08732c185ed068d81877cf4
• c73e33f13481252ec81486cb9e90719c
• eb7cc7cb70d8946f4b25610ca1ba623d
• f4368984793e7ab58357c4f675a84366
• 1e23accebc583eb7be178feabdb826d0
• 43778d3799840872349146c87b247396

SHA-256

• a215dc148ff217dfcdfdb93521dfda34a02db3145b2075ddb1fae5bf02223b08
• d0fedd9bd2cf05e0ee71af4c54649058a93a10dfff08c015e273b02e48b93af0
• ab0f58f35451e95ec8b3f15dbd0a480f97e263708975f41867e3c91978ff7f48
• ad24d8c5ce6e6ef10755dd83a24f13d7d1b42109ff570c3d98fc6a730d452f45
• 511731ff2e08ac1b1de0ca719f3500b2902d7670dd2b2d5b72b3cae847ab42c8
• e361f8adefa02488cceadf7c490784c9da9a9b569d14c4259c12559c1cf223f1
• bc4385e99c66cbcc08ce79bb29e34519a34c1b43546dfdbe9427e899508b2d26
• 1553d8756ce7af3c97291a589fc767b65e0f89940ada15e838243fe292901f42
• 33cecccbe3775e37ae09df298ba21082544164fa8cb32cdda05bfa8e54faa890
• 6b51992fa3dd5ca2525375c9fb2eaa032f031f866fd227a8a524e39d12d5e35e
• 7f149c27e7dc4dfd5f25fd93793dde96e711060881bdfbdd33f8cfdf12674093
• 993045d0a624e821640576570f0d5d2f3693efbd10115f9fb1d3f9ed91764073
• 8159fe10644fad806ddd10bca72efb709b887fed129d123e9772dc99290691c7
• b94ba5a22f2c203224b51c15a546b049a10681904e9e47e84cdd321bedd78bd9
• b2c02f25fdc19bdf994fd1f212a67d3e4fb4433c18af90ac9306c7f97c2d89f1
• 7d5d69c9b9d55da16212b71ab1b69e96f3003c4ef1b0319d5cbcfaeef26948ed
• 17e7883fe9581407529f58472fb1a79d844cc742e5f1454197450b71ff033e16
• 1597e79b7c1783791c96f92cc5a09a0deff7ec682851a881a7e4f4a0c5803309
• 9a509533b5dcd3185c3979b73f5861956a9cc83c16aaa505cb624342cde6ad8e
• 79ce6f9265622d499eb9676a544cfda2cebc14ed9c0131c49cf6e8fa80c4994d
• e0ca6e395499421bc43a41c625e882df76b90edda3652969d5c28175d076a5f3
• d3cd4ae4fa3e760ad3e9495d73cdd0c2699536c5c10f9add84b948730fb1648f
• 81a8050810975fdfcd93f2f0dbcf4c0ee0cda48851a0e56a693b2077b4677a4c
• f5eefed38002d83a9c1f5d993afeba3c358dd1a67272ab3f171e24d5ed894da8
• 91e98e8db0c3443b76ce9358192086d19f6a917820f4e9bd6daf6fd6668eea01
• e1528e284555637fe769177dab7e45ea6292d807448a28be2c465ad245bba428
• 9f590f8661c7c1a0609d77fa553b127ccf1a441cfc02a8656a15b35e53b62044
• fc1450d3df4d99fff2d51e555d829a11b17815d82cb9bba04ec5a32db7cd3e26
• 567a82e21b6b1181def9f254d9af1fa80fb7667db48298989fc7b5a0576cb9de
• 7aa2117be248cdfd46dcf6756fa9dd3d210f71e2254a83d6337c9f102d7100d3
• 51ee1acbf13ac079aeb9749c7feb12f8fa87378d6a2ac94a7c54d7862c8a5563
• 8bf0a31e8c66d353eafa10b862bf58a1974202544e4a5d5a843501b16aa74e8d
• a17d1c6c520f6f4fa1eb9a4411ad37853c946f3870eba8cc4ef3de71c184eeb3
• 03145f98fa416cea6a6fb2e8705fa9a25c70c79e8792dc40c10a62f0f9b4dea8
• 54106c44a7f55a673e9afd9b4415f2a372be49f62f2b1ff3e1196a35fbd0aeef
• 375b8f459c4fe9b3b0a102698578db921914deafec47c7c064ed779a41d0dbc9
• 81daa16a5653573117b94b49d657cdf32d9b88dcb891df3573581bb7478d096b
• 2479f5c4b8c44784ac5c603dadd5fad4ad1b80a8a6198aaf4913a2d1a59e8b01
• 333d13d5d4e6886848640880a8a9abe8d8f5045d116bbaf6bd328f43a8529c00
• 3af8dec60474c1f1c47026ea1aa87f3dc25329d69eed92cbdac95ecabd30e87d
• 45368be16794ebd47ec7b5bf1607eb9d3281ce7101715a1b99b3d50806f090dd
• fc1ee4df3f52cc7d1bbd185beba983a398a4f5f990c4b1f6758e52f34a13024c
• b24dd25b42e82a9b4a3fedf05913a4318154e6b04d7e54510f9d3dcf4c8d3438
• 2ce315aa047239222ede240df7b847f7b5070e792a39d3db148669a4fc07afa8
• 1a8f442575df82083507e18112198b3f7e51c4f5095ba96197468a9d4fca2ffd
• 46d75230716fd873f98c1c28e814ad2576b173bd4b23e44d794091536adb7adb
• a36f63c0ce79bdf4dc74575f26611ff91b4448784e9a5b62f0414eb3e36bf42d
• d43291684d6412f537d7f2001c21ad58313643a3556b730c287aed2015624a31
• 8e37e7c4995235301ce093557f3b0c9eafcc887469eae10d1356e936a18808ed
• f409b059205d9a7700d45022dad179f889f18c58c7a284673975271f6af41794
• b852b2c6b389e3176ceac9549c7d061aa6308f34022a24324dc44f8c39c35f04
• 851ce39495677eb52b5b7ceeeb769aacd9e4de90972a2e3fc51335b954d13aa0
• 07677fcec0276f6108f0a6288b9b12a75025d723b3ee7d494623a998883782f8
• 2a88b8206d7669791a7135c53d0ba7d2bc4d1da9a9972015bd0a1bde3cc9bbbd

SHA1

• 769e510c4d2aeca1a5969381355bb89808cd65fd
• 3d1993fb2ed8b33be17273b5c98394128bde5337
• f095b7df03f545db8ce7f1d931bf524c8d742c60
• 8f8a39f3386120d5fb25f2b7cad224fa5610890c
• 134e4e59c2f3aa22a51a40072e101fa1cf7825e9
• ba219ad16e48c79082067bf51881ecf028961f35
• 967f336bdde9c8f22a193ff3172cc50298584fb7
• bd4fa58168569155d8f837c5ef01b6f4408921ec
• d3ef5e2831ad52946e42f9a1a0dd31e9c2ceccd3
• b1fe8010fc1d27c647b735d6b07279a05b2a8c4b
• 7463479f9aea3d8edc4b012df1012aadc262a9e6
• 8914731f5447553828c6da20cf1fd6cb30fb5718
• 082f393df9ba4bfb73de1b142ecdec0003778e8f
• 456ece6d19bdef0b2db446a67631eb8a734e286d
• 08f20a7cb4af29ba8b7ab5476a08132c1e5b29ea
• 893f0ae5bde30d536d71150a534b3063d5708d8c
• a4c9a1a2dc8ffb6746e63c8ddb6632cc9c104e3a
• 36ec7e81fa89d72e1c4d942a264344b7577f7172

Source IP

• 167[.]71[.]237[.]219

Remediation

• Block the threat indicators at their respective controls.
• Do not download software from unauthentic sources.
• Keep all systems and software updated to latest patched versions.