ThiefQuest

MITRE ATT&CK: S0595 View on attack.mitre.org

Aliases: MacRansom.K, EvilQuest, ThiefQuest

First seen
2020-01-01 00:00:00
Malware type
virus, wiper, trojan, ransomware
Family
Malware family
Operating systems
macos
Related IoCs
64 (64 malicious)
Last IoC activity
2026-10-13 00:24:33
Profile updated
2026-07-07 14:22:14

Targeted regions: country_code:ru

Context

ThiefQuest is a virus, data stealer, and wiper that presents itself as ransomware targeting macOS systems. ThiefQuest was first seen in 2020 distributed via trojanized pirated versions of popular macOS software on Russian forums sharing torrent links. Even though ThiefQuest presents itself as ransomware, since the dynamically generated encryption key is never sent to the attacker it may be more appropriately thought of as a form of wiper malware.

Recent IoC activity

64 malicious indicators in Maltiverse are attributed to ThiefQuest (S0595). The 20 most recently updated:

TypeIndicatorUpdatedSources
file sample d725884e9b70772e213e70969f59f94a96ec27aabb1137067a1f480170e3e6d4 2026-10-13 1
file sample d543749e287e4d97b08dbb1c3332e4a8aa0a4069126a82899b892ee6eb4b3267 2026-10-13 1
file sample 922779bb1360c70cbdde8c0f92caa1d50f8347bd88a6f6736128e8d7dbc2a26f 2026-10-13 1
file sample 41dbfb3d934e970006f196988ab6f4b01fadcb1948d596540e910af9fadae4fb 2026-10-13 1
file sample 2a30b890e89b1f0a772d797f337112a63dfadc9df3104b6a136407086e3a2502 2026-10-13 1
file sample 57b11fc35a53d112c2b0e8288453006453b1de0622f3f4e19e8a75b026d22a36 2026-10-13 1
file sample b4729527483b3071b2ac5b206fa48d02ce1e1a121127f9fe81c9d26add2af004 2026-10-13 1
file sample b49c4b69f827d196b9f1c92d01376f2d308f3400e666e06b727e019cd1d5dc2f 2026-10-13 1
file sample b3f5af02ba6b0ace24f9549721888e1c04c328870e378acdf153b7ae64a83e70 2026-10-13 1
file sample b2ef55c665a86fe5e9fefd5fd39509b75bbd2e21fbb405bf9a945ed9a38c1969 2026-10-13 1
file sample b37c66ab08b8e4200eb72771d720f17973f5294a897a727543c20ec88712082c 2026-10-13 1
file sample b41e9bf03ea42ef1cfa4a16a7f4146d43e3d901f611225d561622da202df0df1 2026-10-13 1
file sample b3b1007dc3c8ee1b846dcc3448c8f912202e9a5ab9c6e0ccdeea21c3467b2d39 2026-10-13 1
file sample b3a7463ac075b963e654facaccbabc364774a2d42d196031a89c70e6afc89b15 2026-10-13 1
file sample 02e10814b103e3e2ea16beba6932887a08a3af9bc7d0d4bb97523d82b9145988 2026-10-13 1
file sample 2026-07-29_a2c3db6a055bba8862034173b6275dfc_adload_evilquest_rekoobe 2026-10-11 1
file sample 3653689f07a2839d9838410d759ba1235bb1e68eef69469e62a739be74082d18 2026-10-05 1
file sample 742145ec198d70d05babcdc499e6ad5337928c06c691ec06e2aa4db788edbb15 2026-10-05 1
file sample 2026-07-29_5d83e8626b2149475316983dc459fcfc_adload_evilquest_rekoobe 2026-09-05 1
file sample 2026-08-28_4827d49e792a3f79e742f69a1d21ce02_adload_evilquest_rekoobe 2026-08-28 1

Detection coverage

  • 336 Sigma rules

Malware & tools used

  • Data Encrypted for Impact (attack-pattern)
  • Web Protocols (attack-pattern)
  • Hidden Files and Directories (attack-pattern)
  • Keylogging (attack-pattern)
  • Disable or Modify Tools (attack-pattern)
  • Compromise Host Software Binary (attack-pattern)
  • Launch Daemon (attack-pattern)
  • Match Legitimate Resource Name or Location (attack-pattern)
  • Exfiltration Over C2 Channel (attack-pattern)
  • AppleScript (attack-pattern)
  • Launch Agent (attack-pattern)
  • Process Discovery (attack-pattern)
  • Reflective Code Loading (attack-pattern)
  • Security Software Discovery (attack-pattern)
  • Native API (attack-pattern)
  • Time Based Checks (attack-pattern)
  • Debugger Evasion (attack-pattern)
  • Ingress Tool Transfer (attack-pattern)

Reports & references

  • MITRE ATT&CK — S0595 (report)
  • blog.malwarebytes.com — Osx Thiefquest (report)
  • blog.malwarebytes.com — Mac Thiefquest Malware May Not Be Ransomware After All (report)
  • objective-see.com — Blog 0X60 (report)
  • blackberry.com — Report Bb 2021 Threat Report (report)
  • malpedia.caad.fkie.fraunhofer.de — Osx.Evilquest (report)
  • github.com — Evilquest Deobfuscator (report)
  • sentinelone.com — Defeating Macos Malware Anti Analysis Tricks With Radare2 (report)
  • CrowdStrike — How Crowdstrike Analyzes Macos Malware To Optimize Automated Detection Capabilities (report)
  • objective-see.com — Blog 0X59 (report)
  • twitter.com — 1277668001538433025 (report)
  • labs.sentinelone.com — Breaking Evilquest Reversing A Custom Macos Ransomware File Encryption Routine (report)
  • sentinelone.com — Evilquest A New Macos Malware Rolls Ransomware Spyware And Data Theft Into One (report)
  • bleepingcomputer.com — Evilquest Wiper Uses Ransomware Cover To Steal Files From Macs (report)
  • objective-see.com — Blog 0X5F (report)

External references