MALICIOUS — 8ac03cbabb7315e23a74a4c2ec3b79fdd3419ec394703cf5b6020ac35f4fe39f

MALICIOUS — 8ac03cbabb7315e23a74a4c2ec3b79fdd3419ec394703cf5b6020ac35f4fe39f is a macho sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Adload family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: 8ac03cbabb7315e23a74a4c2ec3b79fdd3419ec394703cf5b6020ac35f4fe39f
• SHA-1: 7134e436d64423d49347d7dcfbface6af71c9b28
• MD5: 5b4ec0c4abf588061a28c05fc07f8591
• ssdeep: 6144:+qy+DbIWxRBu4IO1WWZscNKoUxVhrQrY6emLCFKcNtTSEjS+pPMMD17ijkBj:Fy+oeRqpaUnhrwYyLWHNtTSEjT
• TLSH: T1735769DBFA662C44A8D1A444DE9602EC00195339E430DBF2DDC2C2895F6AE9DD2EDD1C
• Submitted as: 8ac03cbabb7315e23a74a4c2ec3b79fdd3419ec394703cf5b6020ac35f4fe39f
• File type: macho · Size: 1581000 bytes
• Verdict: malicious (98/100) · Family: Adload

Detections (4 of 56 engines)

• ClamAV (daily): Osx.Adware.Adload-9890129-1
• Microsoft Defender: Adware:MacOS/Adload.D!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Adware.MAC.Adload.24
• Kaspersky (KVRT): HEUR:Trojan-Downloader.OSX.Agent.ad

Why this verdict

The malicious score of 98/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Osx.Adware.Adload-9890129-1 (rule Osx.Adware.Adload-9890129-1) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Adware:MacOS/Adload.D!MTB (rule Adware:MacOS/Adload.D!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.MAC.Adload.24 (rule Gen:Variant.Adware.MAC.Adload.24) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.OSX.Agent.ad (rule HEUR:Trojan-Downloader.OSX.Agent.ad) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis

This sample targets macOS, for which we operate no sandbox guest, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

More Adload samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report