EvilQuest Decryptor

SentinelOne's EvilQuest ransomware decryption tool

by:

• Julien-Pierre Avérous
• Jason Reaves
• Phil Stokes
• Jim Walter

Usage

evilquest-decryptor <input-encrypted-file> <output-decrypted-file>

To learn more about EvilQuest/ThiefQuest malware read our blog: “EvilQuest” Rolls Ransomware, Spyware & Data Theft Into One

To read how we reversed the ransomware: Breaking EvilQuest | Reversing A Custom macOS Ransomware File Encryption Routine