ATT&CK Referencesreed thiefquest ransomware analysis

reed thiefquest ransomware analysis

Thomas Reed. (2020, July 7). Mac ThiefQuest malware may not be ransomware after all. Retrieved March 22, 2021.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1036.005 Match Legitimate Resource Name or Location	MalwareThiefQuest	ThiefQuest prepends a copy of itself to the beginning of an executable file while maintaining the name of the executable. reed thiefquest ransomware analysis wardle evilquest partii
T1041 Exfiltration Over C2 Channel	MalwareThiefQuest	ThiefQuest exfiltrates targeted file extensions in the `/Users/` folder to the command and control server via unencrypted HTTP. Network packets contain a string with two pieces of information: a file path and the contents of the file in a base64 encoded string. reed thiefquest ransomware analysis wardle evilquest partii
T1071.001 Web Protocols	MalwareThiefQuest	ThiefQuest uploads files via unencrypted HTTP. reed thiefquest ransomware analysis wardle evilquest partii
T1554 Compromise Host Software Binary	MalwareThiefQuest	ThiefQuest searches through the `/Users/` folder looking for executable files. For each executable, ThiefQuest prepends a copy of itself to the beginning of the file. When the file is executed, the ThiefQuest code is executed first. ThiefQuest creates a hidden file, copies the original target executable to the file, then executes the new hidden file to maintain the appearance of normal behavior. reed thiefquest ransomware analysis wardle evilquest partii

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.