Skip to content

Malware

EvilQuest

aka ThiefQuest

According to PcRisk, EvilQuest (also known as ThiefQuest) is like many other malicious programs of this type - it encrypts files and creates a ransom message.

EvilQuest, also known as ThiefQuest, is a macOS malware family.

Background

PcRisk notes that EvilQuest (also called ThiefQuest) behaves much like other ransomware of its kind, encrypting files and generating a ransom note. Unlike most such malware, which renames encrypted files by tacking on an extension, this strain leaves the filenames untouched.

It writes a "READ_ME_NOW.txt" ransom note into every folder holding encrypted data and shows an additional ransom message in a pop-up window. Beyond encryption, the malware can check whether particular files are present on the machine, function as a keylogger, and accept commands from a Command & Control server.


Source: Malpedia (Fraunhofer FKIE).