MALICIOUS — e4215d52174a111f2ab1ef5184faa2d72b07294e01efdfd21ab1e16addc4a51d

MALICIOUS — e4215d52174a111f2ab1ef5184faa2d72b07294e01efdfd21ab1e16addc4a51d is a macho sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Adload family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: e4215d52174a111f2ab1ef5184faa2d72b07294e01efdfd21ab1e16addc4a51d
• SHA-1: 3db5e874fdb11bb5e2402ded1f5060e7eaaf8078
• MD5: 0a4e1331da451f3595134fb56b39bc35
• ssdeep: 6144:1W72I06aPqZB11kCSUCKGIf/xsUNMjQ/RkFvVnHCEElQnvpPMMDi7ijkBj:1Wb5jtmIHxsCMEkJ5CEEOnK
• TLSH: T1605757CBFA662C44A8D1A444DE5602EC001A5339E430DBF6DDC2C2895F6AE9DD2EDD1C
• Submitted as: e4215d52174a111f2ab1ef5184faa2d72b07294e01efdfd21ab1e16addc4a51d
• File type: macho · Size: 1585096 bytes
• Verdict: malicious (98/100) · Family: Adload

Detections (4 of 56 engines)

• ClamAV (daily): Osx.Adware.Adload-9890129-1
• Microsoft Defender: Adware:MacOS/Adload.D!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Adware.MAC.Adload.24
• Kaspersky (KVRT): HEUR:Trojan-Downloader.OSX.Agent.ad

Why this verdict

The malicious score of 98/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Osx.Adware.Adload-9890129-1 (rule Osx.Adware.Adload-9890129-1) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Adware:MacOS/Adload.D!MTB (rule Adware:MacOS/Adload.D!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.MAC.Adload.24 (rule Gen:Variant.Adware.MAC.Adload.24) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.OSX.Agent.ad (rule HEUR:Trojan-Downloader.OSX.Agent.ad) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis

This sample targets macOS, for which we operate no sandbox guest, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

More Adload samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report