Overview
overview
4Static
static
1voicewave_...72.exe
macos-10.15-amd64
1voicewave_...72.exe
ubuntu-22.04-amd64
voicewave_...72.exe
debian-9-armhf
voicewave_...72.exe
debian-9-mips
voicewave_...72.exe
debian-9-mipsel
$TEMP/evw_...er.exe
macos-10.15-amd64
1$TEMP/evw_...er.exe
ubuntu-22.04-amd64
$TEMP/evw_...er.exe
debian-9-armhf
$TEMP/evw_...er.exe
debian-9-mips
$TEMP/evw_...er.exe
debian-9-mipsel
$TEMP/evw_...ap.dll
macos-10.15-amd64
4$TEMP/evw_...ap.dll
ubuntu-22.04-amd64
$TEMP/evw_...ap.dll
debian-9-armhf
$TEMP/evw_...ap.dll
debian-9-mips
$TEMP/evw_...ap.dll
debian-9-mipsel
$TEMP/evw_...xe.exe
macos-10.15-amd64
1$TEMP/evw_...xe.exe
ubuntu-22.04-amd64
$TEMP/evw_...xe.exe
debian-9-armhf
$TEMP/evw_...xe.exe
debian-9-mips
$TEMP/evw_...xe.exe
debian-9-mipsel
$TEMP/evw_...up.exe
macos-10.15-amd64
1$TEMP/evw_...up.exe
ubuntu-22.04-amd64
$TEMP/evw_...up.exe
debian-9-armhf
$TEMP/evw_...up.exe
debian-9-mips
$TEMP/evw_...up.exe
debian-9-mipsel
$TEMP/evw_...rl.dll
macos-10.15-amd64
1$TEMP/evw_...rl.dll
ubuntu-22.04-amd64
$TEMP/evw_...rl.dll
debian-9-armhf
$TEMP/evw_...rl.dll
debian-9-mips
$TEMP/evw_...rl.dll
debian-9-mipsel
$TEMP/evw_...40.dll
macos-10.15-amd64
1$TEMP/evw_...40.dll
ubuntu-22.04-amd64
Analysis
- max time kernel
367s - max time network
749s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
06/08/2026, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
voicewave_installer_20260806.17859998182108b4945272.exe
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
voicewave_installer_20260806.17859998182108b4945272.exe
Resource
ubuntu2204-amd64-20260513-en
Behavioral task
behavioral3
Sample
voicewave_installer_20260806.17859998182108b4945272.exe
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral4
Sample
voicewave_installer_20260806.17859998182108b4945272.exe
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral5
Sample
voicewave_installer_20260806.17859998182108b4945272.exe
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral6
Sample
$TEMP/evw_setup/1.0.0/46free/EDownloader.exe
Resource
macos-20250619-en
Behavioral task
behavioral7
Sample
$TEMP/evw_setup/1.0.0/46free/EDownloader.exe
Resource
ubuntu2204-amd64-20260513-en
Behavioral task
behavioral8
Sample
$TEMP/evw_setup/1.0.0/46free/EDownloader.exe
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral9
Sample
$TEMP/evw_setup/1.0.0/46free/EDownloader.exe
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral10
Sample
$TEMP/evw_setup/1.0.0/46free/EDownloader.exe
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral11
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll
Resource
macos-20250619-en
Behavioral task
behavioral12
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll
Resource
ubuntu2204-amd64-20260513-en
Behavioral task
behavioral13
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral14
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral15
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrap.dll
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral16
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe
Resource
macos-20250619-en
Behavioral task
behavioral17
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe
Resource
ubuntu2204-amd64-20260127-en
Behavioral task
behavioral18
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral19
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral20
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/AliyunWrapExe.exe
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral21
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/InfoForSetup.exe
Resource
macos-20250619-en
Behavioral task
behavioral22
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/InfoForSetup.exe
Resource
ubuntu2204-amd64-20260513-en
Behavioral task
behavioral23
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/InfoForSetup.exe
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral24
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/InfoForSetup.exe
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral25
Sample
$TEMP/evw_setup/1.0.0/46free/aliyun/InfoForSetup.exe
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral26
Sample
$TEMP/evw_setup/1.0.0/46free/libcurl.dll
Resource
macos-20250619-en
Behavioral task
behavioral27
Sample
$TEMP/evw_setup/1.0.0/46free/libcurl.dll
Resource
ubuntu2204-amd64-20260513-en
Behavioral task
behavioral28
Sample
$TEMP/evw_setup/1.0.0/46free/libcurl.dll
Resource
debian9-armhf-20260513-en
Behavioral task
behavioral29
Sample
$TEMP/evw_setup/1.0.0/46free/libcurl.dll
Resource
debian9-mipsbe-20260513-en
Behavioral task
behavioral30
Sample
$TEMP/evw_setup/1.0.0/46free/libcurl.dll
Resource
debian9-mipsel-20260513-en
Behavioral task
behavioral31
Sample
$TEMP/evw_setup/1.0.0/46free/vcruntime140.dll
Resource
macos-20250619-en
Behavioral task
behavioral32
Sample
$TEMP/evw_setup/1.0.0/46free/vcruntime140.dll
Resource
ubuntu2204-amd64-20260513-en
General
- Target $TEMP/evw_setup/1.0.0/46free/vcruntime140.dll
- Size 78KB
- Sample260806-jbcaps1sbw
- SHA256 44aca93d4a046252c60f0cbbe5259d9509b912aa07e5379b2cdbe842700c7e9c
- MD5 b8f25e1833429fd8f529c5fdd2a4f3b4
- SHA1 7ae7ca5e695e6cdb590022a0602879bc2f56a65a
- SHA512 077007237e7ddfd280dd08f145a0f3c775c461bbf61574cbefc4f7c29ba6308c16b52da94dc8f78345fec1cdac25f5e604b890669124a7e38e205e54a68729e7
- SSDEEP 1536:JbiyVUrqIQsn1xtg6RxkkBGCGHDWbWzaecbGaBLL+/o8:liyLyt/xcRjWazaecbGCu/o8
- TLSH T1A9737D4335E082B5D9AF05F4D8BAA70A9A7DF8500FF26EE76B944949DF60AC09770307
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/\$TEMP/evw_setup/1.0.0/46free/vcruntime140.dll\""1⤵PID:487
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/\$TEMP/evw_setup/1.0.0/46free/vcruntime140.dll\""1⤵PID:487
-
/usr/bin/sudosudo /bin/zsh -c /Users/run//evw_setup/1.0.0/46free/vcruntime140.dll1⤵PID:487
-
/bin/zsh/bin/zsh -c /Users/run//evw_setup/1.0.0/46free/vcruntime140.dll2⤵PID:489
-
-
/Users/run//evw_setup/1.0.0/46free/vcruntime140.dll/Users/run//evw_setup/1.0.0/46free/vcruntime140.dll2⤵PID:489
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵PID:523
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵PID:523
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵PID:529
-
/usr/sbin/spindump/usr/sbin/spindump1⤵PID:529
-
/usr/libexec/xpcproxyxpcproxy com.apple.AccountPolicyHelper1⤵PID:531
-
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper1⤵PID:531
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵PID:532
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵PID:532