Overview
overview
10Static
static
10Cloud_Upi/...fig.js
windows10-2004-x64
3Cloud_Upi/...fig.js
windows11-21h2-x64
3Cloud_Upi/...ic.key
macos-10.15-amd64
1Cloud_Upi/...ect.js
windows10-2004-x64
3Cloud_Upi/...ect.js
windows11-21h2-x64
3Cloud_Upi/...ify.js
windows10-2004-x64
3Cloud_Upi/...ify.js
windows11-21h2-x64
3Cloud_Upi/...ler.js
windows10-2004-x64
3Cloud_Upi/...ler.js
windows11-21h2-x64
3Cloud_Upi/...MTP.js
windows10-2004-x64
3Cloud_Upi/...MTP.js
windows11-21h2-x64
3Cloud_Upi/.../do.js
windows10-2004-x64
3Cloud_Upi/.../do.js
windows11-21h2-x64
3Cloud_Upi/...ool.js
windows10-2004-x64
3Cloud_Upi/...ool.js
windows11-21h2-x64
3Cloud_Upi/...de.ps1
windows10-2004-x64
3Cloud_Upi/...de.ps1
windows11-21h2-x64
3Cloud_Upi/...ode.js
windows10-2004-x64
3Cloud_Upi/...ode.js
windows11-21h2-x64
3Cloud_Upi/...ode.js
windows10-2004-x64
3Cloud_Upi/...ode.js
windows11-21h2-x64
3Cloud_Upi/...put.js
windows10-2004-x64
3Cloud_Upi/...put.js
windows11-21h2-x64
3Cloud_Upi/...ge.bat
windows10-2004-x64
1Cloud_Upi/...ge.bat
windows11-21h2-x64
1Cloud_Upi/...rge.sh
ubuntu-18.04-amd64
Cloud_Upi/...rge.sh
debian-9-armhf
Cloud_Upi/...rge.sh
debian-9-mips
Cloud_Upi/...rge.sh
debian-9-mipsel
Cloud_Upi/...ity.js
windows10-2004-x64
3Cloud_Upi/...ity.js
windows11-21h2-x64
3Cloud_Upi/...ay.svg
windows10-2004-x64
3Analysis
- max time kernel
112s - max time network
106s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
05/05/2026, 12:21
Behavioral task
behavioral1
Sample
Cloud_Upi/HDFCSoft/config.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral2
Sample
Cloud_Upi/HDFCSoft/config.js
Resource
win11-20260130-en
Behavioral task
behavioral3
Sample
Cloud_Upi/HDFCSoft/public.key
Resource
macos-20250619-en
Behavioral task
behavioral4
Sample
Cloud_Upi/HDFCSoft/upicollect.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral5
Sample
Cloud_Upi/HDFCSoft/upicollect.js
Resource
win11-20260130-en
Behavioral task
behavioral6
Sample
Cloud_Upi/HDFCSoft/upiverify.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral7
Sample
Cloud_Upi/HDFCSoft/upiverify.js
Resource
win11-20260130-en
Behavioral task
behavioral8
Sample
Cloud_Upi/PHPMailer/PHPMailer.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral9
Sample
Cloud_Upi/PHPMailer/PHPMailer.js
Resource
win11-20260130-en
Behavioral task
behavioral10
Sample
Cloud_Upi/PHPMailer/SMTP.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral11
Sample
Cloud_Upi/PHPMailer/SMTP.js
Resource
win11-20260130-en
Behavioral task
behavioral12
Sample
Cloud_Upi/Qrcode/do.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral13
Sample
Cloud_Upi/Qrcode/do.js
Resource
win11-20260130-en
Behavioral task
behavioral14
Sample
Cloud_Upi/Qrcode/imb_disable-devtool.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral15
Sample
Cloud_Upi/Qrcode/imb_disable-devtool.js
Resource
win11-20260130-en
Behavioral task
behavioral16
Sample
Cloud_Upi/Qrcode/phpqrcode/bindings/tcpdf/qrcode.ps1
Resource
win10v2004-20260130-en
Behavioral task
behavioral17
Sample
Cloud_Upi/Qrcode/phpqrcode/bindings/tcpdf/qrcode.ps1
Resource
win11-20260130-en
Behavioral task
behavioral18
Sample
Cloud_Upi/Qrcode/phpqrcode/phpqrcode.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral19
Sample
Cloud_Upi/Qrcode/phpqrcode/phpqrcode.js
Resource
win11-20260130-en
Behavioral task
behavioral20
Sample
Cloud_Upi/Qrcode/phpqrcode/qrencode.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral21
Sample
Cloud_Upi/Qrcode/phpqrcode/qrencode.js
Resource
win11-20260130-en
Behavioral task
behavioral22
Sample
Cloud_Upi/Qrcode/phpqrcode/qrinput.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral23
Sample
Cloud_Upi/Qrcode/phpqrcode/qrinput.js
Resource
win11-20260130-en
Behavioral task
behavioral24
Sample
Cloud_Upi/Qrcode/phpqrcode/tools/merge.bat
Resource
win10v2004-20260130-en
Behavioral task
behavioral25
Sample
Cloud_Upi/Qrcode/phpqrcode/tools/merge.bat
Resource
win11-20260130-en
Behavioral task
behavioral26
Sample
Cloud_Upi/Qrcode/phpqrcode/tools/merge.sh
Resource
ubuntu1804-amd64-20260126-en
Behavioral task
behavioral27
Sample
Cloud_Upi/Qrcode/phpqrcode/tools/merge.sh
Resource
debian9-armhf-20260127-en
Behavioral task
behavioral28
Sample
Cloud_Upi/Qrcode/phpqrcode/tools/merge.sh
Resource
debian9-mipsbe-20260126-en
Behavioral task
behavioral29
Sample
Cloud_Upi/Qrcode/phpqrcode/tools/merge.sh
Resource
debian9-mipsel-20260126-en
Behavioral task
behavioral30
Sample
Cloud_Upi/Qrcode/security.js
Resource
win10v2004-20260130-en
Behavioral task
behavioral31
Sample
Cloud_Upi/Qrcode/security.js
Resource
win11-20260130-en
General
- Target Cloud_Upi/HDFCSoft/public.key
- Size 451B
- Sample260505-pjmpasfx21
- SHA256 b382b6b27cb1096329e715571549b58fc0f788abfcebf8cae1ae54a059ce83d3
- MD5 990a9af575cd7501ae7d96d9151ade53
- SHA1 dd018e7368c29f33d5d98dcbaf26cf260b23adf6
- SHA512 788e7955ca55ee5933f0961d946a3000824208ca6348a2e3524bbea0fb0a702d739619848ba13d7b4181134e75c97c48b7a84937673ad3388b3f853240a859ca
- TLSH T150F0DCC02E556CD85A3CE7CE8ED3819493AAD1766B51700882E1A0868050CF0BACC0A3
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Cloud_Upi/HDFCSoft/public.key\""1⤵PID:501
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Cloud_Upi/HDFCSoft/public.key\""1⤵PID:501
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/Cloud_Upi/HDFCSoft/public.key1⤵PID:501
-
/bin/zsh/bin/zsh -c /Users/run/Cloud_Upi/HDFCSoft/public.key2⤵PID:502
-
-
/Users/run/Cloud_Upi/HDFCSoft/public.key/Users/run/Cloud_Upi/HDFCSoft/public.key2⤵PID:502
-
-
/bin/shsh /Users/run/Cloud_Upi/HDFCSoft/public.key2⤵PID:502
-
-
/bin/bashsh /Users/run/Cloud_Upi/HDFCSoft/public.key2⤵PID:502
-
aRdjn+FAqGQ2KAZ9zwrlpyNMuXAbAxQq6DL/Cq9p6E/ERhD/seSou1K+Ya0hu6ItaRdjn+FAqGQ2KAZ9zwrlpyNMuXAbAxQq6DL/Cq9p6E/ERhD/seSou1K+Ya0hu6It3⤵PID:506
-
-
Ev3nxaUXJsrFD93bKEn7rLTCf6LSA2l5sYOjrXAK9e/IJsunBZdspU0HAoby9cZnEv3nxaUXJsrFD93bKEn7rLTCf6LSA2l5sYOjrXAK9e/IJsunBZdspU0HAoby9cZn3⤵PID:509
-
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.sysmond1⤵PID:512
-
/usr/libexec/sysmond/usr/libexec/sysmond1⤵PID:512
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.systemsoundserverd1⤵PID:513
-
/usr/sbin/systemsoundserverd/usr/sbin/systemsoundserverd1⤵PID:513
-
/usr/libexec/xpcproxyxpcproxy com.apple.audio.AudioComponentRegistrar1⤵PID:514
-
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon1⤵PID:514
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵PID:566
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵PID:566
-
/usr/libexec/xpcproxyxpcproxy com.apple.StreamingUnzipService 1861⤵PID:571
-
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService1⤵PID:571
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon1⤵PID:581
-
/bin/launchctl/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon1⤵PID:582
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:595
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:595