aol.pm

ThiefQuest

Software · ATTACK:enterprise:S0595

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S0595",
  "title": "ThiefQuest",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0595",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--727afb95-3d0f-4451-b297-362a43909923",
  "external_id": "S0595",
  "domain": "enterprise",
  "created": "2021-03-19T16:26:04.260Z",
  "modified": "2025-04-16T20:38:16.679Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "ThiefQuest"
    },
    {
      "source_name": "EvilQuest"
    },
    {
      "source_name": "MacRansom.K"
    },
    {
      "source_name": "wardle evilquest partii",
      "url": "https://objective-see.com/blog/blog_0x60.html"
    },
    {
      "source_name": "SentinelOne EvilQuest Ransomware Spyware 2020",
      "url": "https://www.sentinelone.com/blog/evilquest-a-new-macos-malware-rolls-ransomware-spyware-and-data-theft-into-one/"
    },
    {
      "source_name": "Reed thiefquest fake ransom",
      "url": "https://blog.malwarebytes.com/detections/osx-thiefquest/"
    },
    {
      "source_name": "reed thiefquest ransomware analysis",
      "url": "https://blog.malwarebytes.com/mac/2020/07/mac-thiefquest-malware-may-not-be-ransomware-after-all/"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02c4488b-6041-4222-9363-18a63ce3b835

wardle evilquest partii

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30496669-0d01-4855-b566-6d5bfd9c97c1

wardle evilquest partii · reed thiefquest ransomware analysis

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4306857b-542d-4a54-8b4d-b835e52c5c15

wardle evilquest parti

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--438f9fb0-bf82-4c72-8fdf-0dbc39bcf4fc

Trendmicro Evolving ThiefQuest 2020

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60827b66-e9a2-4da6-b589-492d3f7eebcd

wardle evilquest parti

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1554

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7300af33-a55d-47a7-86a6-3b756abfc8e5

wardle evilquest partii · reed thiefquest ransomware analysis

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1543.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--73798ada-f5a4-4029-ac0c-39bcae68df98

wardle evilquest parti

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75155c7f-3804-4f83-bbcb-4f654a5182e5

wardle evilquest partii · reed thiefquest ransomware analysis

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1041

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cfc1c10-b3d5-4e9e-907e-7379c3771161

wardle evilquest partii · reed thiefquest ransomware analysis

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1059.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96af7164-6259-42cd-9007-e882be986dfa

wardle evilquest parti

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1543.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--979bd2a9-bc77-4741-bc79-0badc9e1e98c

wardle evilquest parti

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c85af3d4-ab10-4c49-91c4-bff9054096b8

wardle evilquest parti

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d11da8db-b528-4d1f-a7f4-ba8bafb80a3d

wardle evilquest partii

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d236947c-849f-4f4f-9ee5-ab4b78d04ef6

wardle evilquest parti

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1106

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dde881dc-6ad3-4819-b339-8019074818c7

wardle evilquest partii

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1497.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e46888e6-8c13-4a9c-8638-f8c151bec3c6

wardle evilquest parti

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1622

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e711d51c-94d3-4a20-ae11-d3584bae36d9

wardle evilquest partii

ATTACK:enterprise:S0595 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea4871e2-8754-4002-9e76-a2c1c0ed7e2f

wardle evilquest partii

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.