MALICIOUS — f9a7aaf2736e6148363fe2d9ab0822a4947a694055df6776bf8a91714a84ab3a

MALICIOUS — f9a7aaf2736e6148363fe2d9ab0822a4947a694055df6776bf8a91714a84ab3a is a macho sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Adload family. 4 of 56 detection engines flagged it.

Identification

• SHA-256: f9a7aaf2736e6148363fe2d9ab0822a4947a694055df6776bf8a91714a84ab3a
• SHA-1: 2b26cbdbe48e42841c370234178ba19f7a3d98a3
• MD5: 4a7487f57f8d9b8abd3257f8b94293f4
• ssdeep: 6144:abmFLoc0l2LagnHld3W7EmzKG6fHXr+JcpcUajFgetXmjiEYbeMpPMMDQ7ijkBj:abmFcc0aVyf6/XrQcexj+KXCiEQeh
• TLSH: T1AC5758CBFA662C44A8D1A444DE5602EC00195339E430DBF6DDC2C2895F6AE9ED2EDD1C
• Submitted as: f9a7aaf2736e6148363fe2d9ab0822a4947a694055df6776bf8a91714a84ab3a
• File type: macho · Size: 1601480 bytes
• Verdict: malicious (98/100) · Family: Adload

Detections (4 of 56 engines)

• ClamAV (daily): Osx.Adware.Adload-9890129-1
• Microsoft Defender: Adware:MacOS/Adload.D!MTB
• Emsisoft (Emergency Kit): Gen:Variant.Adware.MAC.Adload.24
• Kaspersky (KVRT): HEUR:Trojan-Downloader.OSX.Agent.ad

Why this verdict

The malicious score of 98/100 is the fusion of 4 weighted signals:

• ClamAV (daily) flagged Osx.Adware.Adload-9890129-1 (rule Osx.Adware.Adload-9890129-1) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Adware:MacOS/Adload.D!MTB (rule Adware:MacOS/Adload.D!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Adware.MAC.Adload.24 (rule Gen:Variant.Adware.MAC.Adload.24) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.OSX.Agent.ad (rule HEUR:Trojan-Downloader.OSX.Agent.ad) - engine signal, weight 0.55, confidence 0.85

Dynamic analysis

This sample targets macOS, for which we operate no sandbox guest, so it was not detonated. The absence of runtime behaviour here is a coverage gap on our side, not a finding about the sample.

More Adload samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report