Executive Summary
- AdLoad is one of several widespread adware and bundleware loaders currently afflicting macOS.
- In late 2019, SentinelLabs described how AdLoad was continuing to adapt and evade detection.
- This year we have seen over 150 unique samples that are part of a new campaign that remain undetected by Apple’s on-device malware scanner.
- Some of these samples have been known to have also been blessed by Apple’s notarization service.
- We describe the infection pattern and detail the indicators of compromise for the first time.
Introduction
AdLoad is one of several widespread adware and bundleware loaders currently afflicting macOS. AdLoad is certainly no newcomer to the macOS malware party. In late 2019, SentinelLabs described how AdLoad was continuing to adapt and evade detection, and this year we have seen another iteration that continues to impact Mac users who rely solely on Apple’s built-in security control XProtect for malware detection.
In this post, we detail one of several new AdLoad campaigns we are currently tracking that remain undetected by Apple’s macOS malware scanner. We describe the infection pattern and indicators of compromise for the first time and hope this information will help others to detect and remove this threat.
AdLoad | Staying One Step Ahead of Apple
AdLoad has been around since at least 2017, and when we previously reported on it in 2019, Apple had some partial protection against its earlier variants. Alas, at that time the 2019 variant was undetected by XProtect.
As of today, however, XProtect arguably has around 11 different signatures for AdLoad (it is ‘arguable’ because Apple uses non-industry standard names for its signature rules). As best as we can track Apple’s rule names to common vendor names, the following XProtect rules appear to be all partially or wholly related to AdLoad variants:
The good news for those without additional security protection is that the previous variant we reported in 2019 is now detected by XProtect, via rule 22d71e9.
The bad news is the variant used in this new campaign is undetected by any of those rules. Let’s see what’s changed.
AdLoad 2021 Campaign | ‘System’ and ‘Service’
Both the 2019 and 2021 variants of AdLoad used persistence and executable names that followed a consistent pattern. In 2019, that pattern included some combination of the words “Search” , “Result” and “Daemon”, as in the example shown above: “ElementarySignalSearchDaemon”. Many other examples can be found here.
The 2021 variant uses a different pattern that primarily relies on a file extension that is either .system or .service. Which file extension is used depends on the location of the dropped persistence file and executable as described below, but typically both .system and .service files will be found on the same infected device if the user gave privileges to the installer.
With or without privileges, AdLoad will install a persistence agent in the user’s Library LaunchAgents folder with patterns such as:
~/Library/LaunchAgents/com.ActivityInput.service ~/Library/LaunchAgents/com.AnalyzerWindow.service ~/Library/LaunchAgents/com.AssistiveFile.service ~/Library/LaunchAgents/com.BoostConsole.service ~/Library/LaunchAgents/com.DefaultTool.service ~/Library/LaunchAgents/com.ElementaryType.service ~/Library/LaunchAgents/com.ExtendedSprint.service ~/Library/LaunchAgents/com.SwitcherGuard.service
To date, we have found around 50 unique label patterns, with each one having both a .service and a .system version. Based on our previous understanding of AdLoad, we expect there to be many more.
When the user logs in, the AdLoad persistence agent will execute a binary hidden in the same user’s ~/Library/Application Support/ folder. That binary follows another deterministic pattern, whereby the child folder in Application Support is prepended with a period and a random string of digits. Within that directory is another directory called /Services/, which in turn contains a minimal application bundle having the same name as the LaunchAgent label. That barebones bundle contains an executable with the same name but without the com. prefix. For example:
~/Library/Application Support/.3276169528277499560/Services/com.SwitcherGuard.service/SwitcherGuard.service
A hidden tracker file called .logg and containing only a UUID string is also dropped in the Application Support folder. Despite the location, if the dropper has also been granted privileges, then the tracker file is owned by root rather than the user.
Further, assuming the user supplied admin privileges as requested by the installer, another persistence mechanism is written to the domain /Library/LaunchDaemons/ folder. This plist file uses the file extension .system, and the corresponding folder in the hidden Application Support folder is also named /System/ instead of /Services/.
The LaunchDaemon is dropped with one of a number of pre-determined labels that mirrors the label used in the LaunchAgent, such as:
/Library/LaunchDaemons/com.RecordMapper.system /Library/LaunchDaemons/com.SectionaAssist.system /Library/LaunchDaemons/com.SectionAssist.system /Library/LaunchDaemons/com.SectionChannel.system /Library/LaunchDaemons/com.StandardBoost.system /Library/LaunchDaemons/com.SwitcherGuard.system /Library/LaunchDaemons/com.TypeCharacter.system /Library/LaunchDaemons/com.TypeInitiator.system
The persistence plists themselves pass different arguments to the executables they launch. For the system daemon, the first argument is -t and the second is the plist label. For the user persistence agent, the arguments -s and 6600 are passed to the first and second parameters, respectively.
Interestingly, the droppers for this campaign share the same pattern as Bundlore/Shlayer droppers. They use a fake Player.app mounted in a DMG. Many are signed with a valid signature; in some cases, they have even been known to be notarized.
Typically, we observe that developer certificates used to sign the droppers are revoked by Apple within a matter of days (sometimes hours) of samples being observed on VirusTotal, offering some belated and temporary protection against further infections by those particular signed samples by means of Gatekeeper and OCSP signature checks. Also typically, we see new samples signed with fresh certificates appearing within a matter of hours and days. Truly, it is a game of whack-a-mole.
The droppers we have seen take the form of a lightly obfuscated Zsh script that decompresses a number of times before finally executing the malware out of the /tmp directory (for a discussion of how to deobfucscate such scripts see here).
The final payload is not codesigned and isn’t known to the current version of Apple’s XProtect, v2149.
How New Is This Variant of AdLoad?
In our investigation, we found over 220 samples of this adware variant on VirusTotal, in both packed and unpacked form. At least 150 of these are unique. Interestingly, a lone sample of this variant was documented by analysts at Confiant, who described the malware’s string decryption routine in a post published on June 3rd, 2021. According to these researchers, the sample they observed had been notarized by Apple.
We note that across our corpus, all samples from November 2020 to August 2021 use the same or similar string decryption routine as that described by Confiant. Similarly, the earlier researchers’ sample, “MapperState.system” conforms to the AdLoad naming pattern that we observed and described above. Both these indicators definitively link our findings with theirs.
Our research showed that samples began to appear at least as early as November 2020, with regular further occurrences across the first half of 2021. However, there appears to have been a sharp uptick throughout July and in particular the early weeks of August 2021.
It certainly seems possible that the malware developers are taking advantage of the gap in XProtect, which itself has not been updated since a few week’s after Confiant’s research over two months ago. At the time of writing, XProtect was last updated to version 2149 around June 15th – 18th.
None of the samples we found are known to XProtect since they do not match any of the scanner’s current set of AdLoad rules.
However, there is reasonably good detection across a variety of different vendor engines used by VirusTotal for all the same samples that XProtect doesn’t detect.
On our test machine, we set the policy of the SentinelOne Agent to “Detect only” in order to allow the malware to execute and observe its behaviour. In the Management console, the behavioral detection is mapped to the relevant MITRE indicators.
Since AdLoad is a common adware threat whose behavior of hijacking search engine results and injecting advertisements into web pages has been widely documented in the past, we ended our observation at this juncture.
Conclusion
As Apple itself has noted and we described elsewhere, malware on macOS is a problem that the device manufacturer is struggling to cope with. The fact that hundreds of unique samples of a well-known adware variant have been circulating for at least 10 months and yet still remain undetected by Apple’s built-in malware scanner demonstrates the necessity of adding further endpoint security controls to Mac devices.
As we indicated at the beginning of this post, this is only one campaign related to AdLoad that we are currently tracking. Further publications related to these campaigns are in progress.
Indicators of Compromise
YARA Hunting Rule
private rule Macho
{
meta:
description = "private rule to match Mach-O binaries"
condition:
uint32(0) == 0xfeedface or uint32(0) == 0xcefaedfe or uint32(0) == 0xfeedfacf or uint32(0) == 0xcffaedfe or uint32(0) == 0xcafebabe or uint32(0) == 0xbebafeca
}
rule adload_2021_system_service
{
meta:
description = "rule to catch Adload .system .service variant"
author = "Phil Stokes, SentinelLabs"
version = "1.0"
last_modified = "2021-08-10"
reference = "https://s1.ai/adload"
strings:
$a = { 48 8D 35 ?? ?? 00 00 48 8D 5D B8 BA B8 00 00 00 48 89 DF E8 ?? ?? FB FF 48 8B 43 08 48 2B 03 66 48 0F 6E C0 66 0F 62 05 ?? ?? 00 00 66 0F 5C 05 ?? ?? 00 00 0F 57 C9 66 0F 7C C0 48 8D 7D A0 0F 29 0F F2 0F 59 05 }
condition:
Macho and all of them
}
Persistence Filepaths
~/Library/LaunchAgents/com.<label>.service.plist /Library/LaunchDaemons/com.<label>.system.plist
Executable Paths
~/Library/Application Support/.[0-9]{19,}/Services/com.<label>.service/<label>.service
/Library/Application Support/.[0-9]{19,}/System/com.<label>.system/<label>.system
Labels
AccessibleTask
ActivityElement
ActivityInput
AnalyzerWindow
AssistiveFile
AssistiveRecord
BoostConsole
BrowserActivity
BufferRecord
CleanParameter
CompellingState
ConfigProgress
ConfigType
ConnectionCache
DefaultTool
DeskProduct
DesktopInput
DominantCommand
DominantPartition
ElementaryType
ElemntState
EssentialDesktop
EssentialType
ExploreActivity
ExploreAnalog
ExploreSync
ExtendedSprint
GeneralObject
GuideRecord
InetImprovment
InitialProgram
InitialSkill
LeadingUpdater
ManagerAnalog
MapperState
OperativeMachine
OperativeUnit
OpticalUpdater
OriginalModule
RecordMapper
SectionAssist
SectionChannel
SkillApplication
SkillFormat
SkilledObject
SkilledUnit
StandardBoost
SwitcherGuard
TopProcesser
TrustedAnalog
TypeCharacter
TypeInitiator
TypicalProcess
UnitHandler
ValidBoost
MITRE
T1211 Defense Evasion
T1105 Remote File Copy
T1160 Persistence
SHA1 HASHES
.service, .system files
4c644adcdcc68c6c52e95bd851e7c944f307d968
6056024b3cf90b01b737c54ed5c785271c3acfeb
c2663bfe8fcf0734263cdf0875dcfad517576238
c5e2851de071001614dd58ecfab565614a6151b6
8e657ad96feb624696bad2b7b1e0d5d58da3ca94
b70a3c4b7f3d4e99fdf84efbeae7a39638221e59
2336c5e42444619d0c69d4cab1fc5b54ae92a0ec
e8d202e3581bf29c31e6f7fc279dc70d517510a8
722352a3a4a6f2a876dea90624991053034da555
95f74e68ed970c304d9ea39e2cd75bc3309cb4d2
4d258fefe729f16a55904ba993d783241d95dcd9
f250b4be027ff4a6a87b0dcf2cff5fd0acc11f0f
dd7df2bd2280213545fd3c6c0f9095d8c349f480
4ca250b74d1ee759bb51f3c50161c793a17da61d
446804008faf8a5509a02412f1e2f3a97e433cc0
525244f96c0225f279a6fa6dff55ed6de114334b
cc56bd813f34a3e19286ef211132a39e5f3f4c50
dfa112d78d5a49282fe2494ab11bb4e924fc1d9a
bf78c2f48991a8024b0c831c5a54324ca937c1b6
f3b01c0710a5fe623c4a944b1357c279a7310f35
670abdf80ea4e689ca376514dd76865ad22e39ec
cc4b56ded4a1f28396cb1ac625467b1c43c3cc0c
9eff76bc9c6cc6c88c438f7c442027cdb22e5d8d
034feaca526a21fce14e5a59df2a15ec840dc15d
f0bf049ac35b5d239fd386b81d03d9efd9049d0b
5060e552a2a78ff477f6c8ed09147bac31a8ad23
a163ad595be34988fa70bd57b2fa238ac36e43e2
210d1951430f7a7daf88bf40c72df6a2d1336e97
a7ae668be424e4fe5ce1758dd507cef58274ebb2
67825f467de2f988d62537b17286c7411366bf3c
17620732836f1edaa7d4f4a3623bfaee9851f060
a1735e52f37288b5c96ba72b121de1c79ae72bc9
4270783f1347a5bd0df6a9ad77352ff6aa4a81ae
b157cbdf8877f1aaa4415020bf976dae3af2ad98
d0fc30037dde0d6705eff642cd80f0a92bc23ab7
e9682590793c44c1ef20f455aa4f9aefe606e3d8
823d61b03e96951167753003d203e72b4b4bd42c
ab4bd98c0f798bb7e9344fa7b51aabece59c25f7
45aef3a5a171e49aab7e165c184e43dcab349d91
7bfc4d9051e216b99e5858bf653ed983d1fe0aaf
8f9889f93a86ba80e42b5ed314ee926b202878e8
2ae527b7e10097280f5101b0b586f64d4e6bdb46
1925e3f88a092e1a543e1042bb403794832c4beb
dd14fd2d3e498a9b41295a7f9ddd69ca6de6742b
d6697b70f598ac6fb8c68231eea0fcda28225f7c
d2fc35e7c55ae26985dba531c4492188fdc13f86
3656aa007b5d05277ba5527a71fd09ffa41137bc
bc614964673cad434cbfedb5b47d037f99919339
96c1563aea4242b3a014a6638e1fe616e93f213f
a6e24a3e051546e16a038e02efe8f5ae3df11536
3b1b832d418c9b3645bf1cd0bf3bd634a2cb15f9
1c713fe9ef48ffb4adda26fd59a4c16333602802
85171a3cf0f663d265da94a5387e42116a828819
c104163b139d20cb3727e89934a2c7352723514c
fa8c35b469bb7dd50166d70aae93a8ba2f5721b9
fff8dace788ffa2188c61b5efe95d07ca719056b
487aab1583b1258932461b7eaba565840439d77c
4bdfeb9e9dee0decb551838ab9fb19d21ac76375
243adaa1955e4a4a57cf240c0d4773c10e5d66a5
b037982890cb4cd39771d0a19615d5fb49b0fc64
59234581da266da1257a9fe1de45c8259e22ac1c
6dffb483119f0a2f97e000830a4bfc0aa1e1f696
081dfd7795bd82d037cffca5ad714fa72db28e3d
be2add2c4a065a481a3276efc9078fe2e6a2eba3
219fb270e5f3ac942bab082f12fc45141b5a28d2
233d33a3d8d4cde33761e42c7d969c6316e14796
880f3cbfecb20b80131b689b3ae94325bdec6996
008eaa5489dc86643ef516b23258a02111544124
8523259f5b74f3405d5c3ca36b7c238a8b0db5f8
e9a450988933b11c73a0160c157f6965c111a7a5
95579871c86810a9bbf238f325d470cd7b08a94d
f2462e0daaf3b23b7ab73e695f1ae8b036273493
5cce9004ce7134e3b62b9d5d733347c048830231
f5b6b5fabad5aba545d259f1370130f5295b5692
ac168a783051f3322bb43a72518d49f67d084166
7c2455ca1eb1cd8eec91acf21a501e96c8d715ac
71c9ab91cb285e71fe144e4f0626cf9b3f7f7adb
f161b7250d79b89abed92affc764b2925ed05182
6f32bd0c8a8120b2a73a3a412a480345e464790c
5c5830f13ef7d20a60cddb6aa2ce63794574d466
622cfea78f430473478d98d33a985190402e2f0b
d5aeabcc77d11e45017341e102c4d58391a5fbb2
a3323205db565f2c6e0182853138ce7a66807ac7
fc9ff33a949ee9001f5537a1efde8dc4e2b994c8
ca35bd32d135d8513a81866836a8fe73de970266
8fb2b387c9b95f9f9a408f528462eb57a96e34f6
e85e710f12f34be87b4e0bb9fe34547e69ad6db0
4a63e937779c52d034c0d276ef46e99e1f49596a
941388e2880fe447fd958d78655264639549373e
b4395d37fb0b78422e959c4e8d3ed984f01ba518
e1271de943444766687b6d5c707fa66a5b71e8f0
7c7af95109714cfd0108536aa21c2461b5d7c451
d39f7d5a0d9923aed5d06155b1caf38c8279b916
b221b50ccec7c6f7d309f643dd2ee287f2569176
b4193cf5f0d9f07f0afe8a46b405b460293082d0
3025d8a5463dc409af8c85742924373ba7e87e11
197f700c045c43eecae02130d990a9dbba2f9802
763fb085dfe338a286302c72869deacc1ab0372d
8f5a7c48f2a4fdbd3f0d0cdaf313163034b02a88
a81ce8cdd485a265e16a374101cd3c712d651674
a248211f67ea4874418961a8c596d7183d71131f
4a534ab4dfe55e8a7da79a96cdb46b1fa0fa9e47
d3514efe6ec9b4dbe012e6a5a971004818d877e5
b2f645477fbe5d9bddbec96d267fae1518920517
66c9e7846a2263484f6b2b3653c137229e18feeb
7f8ef2c17a9347e52b9c8eab385f2a774d6a1b76
9430703cb3bc6a0454cf4da07191f10b20af3e76
b4280bd84e160b285500d944ca7f14696d2be457
61acc635fc38d785aa95abc8f9f39bb9e853ccfd
e3029f78731161c75bfd8ab53c86811b927c31a8
16cd7d7d66685689453241557106772ce6f6d21c
4a805fde7a28d3c3188c4398ce603a13d757438c
1ee378795e80a43fcb07678e8582fa6e44c605f8
14c17fac581df68923016a7a56bf39d8290e6abc
46264a0381a0399dd4fd9b30cac0b354be34e304
49ca8c02d0d67040079d5b8185fe4947e5101cf7
62c4c86734c980310e6a204657b17154f8feecc4
8e1c36a686e00a0878525eeef99d48c88f040022
1bd022f25a21f1cbcaaf1481c5d34df46f0a6b2c
4243c523775a98c8d6cc9398857e5813d4dd0842
5a715a77b274d6ab4d6d85fa025deb75a92b3b2f
ffc52b694ac6cb43b852ddbf02ef83e1d2d696f5
ee88a8865110fb4d454a211d52122e09366ab435
2530637b96d9e82a2d49a47ac846ad6737fec83d
8295fef63f90b2ef93fdba41aa0f04ca720c6d5f
034676a0fe5115e10fe256ed94bdd5941d8b7b26
8e2b172fc2846abf48c2f4fde6110d89c60d1c8c
80fa5be5953c3a199fe41469b3e11f8e26a30131
5d85b530b2bdcc30875fccbce189b650bec62366
673ab255386b1a000369ebcacd0669333a4a746f
5b40003f3b3dbb8a79bb70e1a6ac62c8bd14501c
88a9162b8887beb36e487c4e156e5bb25a129c37
a58b7e2f8e15039887d813dc51230f5a58ce964c
9d0b08c8f13402d074011e0cba6fb0b1571132bd
13b49b0dd0dc95059da81569f29d4bedbc07faab
3f0b3b6835a363c4e01401e28bde66277693e46b
11a882ea1a8c62e362725528463a95eeeb7f7103
e3c226bf3a5c6a3cd4bbedf3fd5db00dfd5e6f8b
8571ad38afe8721491c6d50631836db35c3ca701
a27d3cc014391f47b1174bfe8b2cdbf9ec23daf5
7792403a0a6400dfb79db20d6af346685b9f4774
6b133d16402015822467ea1ff4204bc40dff2e0f
163d2e6daecbc419d3e9a011b04c6b62488a9a8e
6693c6d4061fae64aac86e17b4fa72d1a7491fe7
72aec20fa4da9d8024e5aa94dd43c3ed6ce703c5
0cde09d5b18517d4e1632cff3f90fcb33d0dd225
b9bc88fa57f19a095ed00a664e671ebb2c095b2f
ec11dc98fbea6f6ba7a8e94c5aebee25815b3ba1
557d20e8c938228b6ea569fd3ab23359b174bbe1
98ffb280981218316c32624fe991d1d5cb81e319
ada45f83ed15138b7a58e55cac613d93814d6ed6
2b4526e0fe5526800ed9475161f31786380753ca
95953e735dc82564816be0178ad3aaefeff13a8e
5364effde06a4e09afb5c0a6b9179a8e75776cd1
075fcc3777a706cae6af9ac514322011ab9a4a14
17321a3e97ebd5b85be4b2f88e1f6799214a711b
807975a15e04822d5b6abfd54cfc6def4d61613b
735a97d21e91023a33575946373b0f7a7ba80d32
ae3e2a14ea5df3efc10af45755a14ed3b4c67524
a7b9ce7c5dce62258d4d4fa17bfe1273778766c3
7ef3de49716784d9d7f50fb96b9a7ad090a052f8
b47adfa20cf16871a7c18f9cdfa855765ff5eaca
10821b9bba7cca78cd118c942b73e4b2575ee4c8
652747b071b2bb4c445f994504726861933c5249
f28add9e3d21b8cfbffb60d12760dd307cfe356e
e49db30e36b1172301ef2f8b000a074e19dc1ac9
6ccedd0e86de1419011a956de435a46243378c0e
211d1b64b0e8ee4087198318b40e1be6204a9f93
8e0509d8e59edef9e582e725bd67c7e553832a34
63755111ca179fb1cd10173677742e529884befb
2b42863c1f9a7228e6a71f8dbaf3b149bc19b3b7
c33322c363a1ef6a34f2e21d850f0c31dea960e9
e504942c5b3200c6e455bc7bdb0e0a6786dceb42
b0aa5e49cfebcc16d3a3e4763fa2ff142c4d3ce4
cccdbdf2b14d12e0ae0d963ba6b396650f88b4a1
7a8f664bef819a79c343fc8b40442f212c18372d
285233cbfbdd4e7435a228ef831005f07b125e0d
4ee3307291731974f0f250faea384c43333d8484
5f32868dfde684b2d174bdb3f58adc832a24128e
14fb3f59923f7697ad0997172d6a876415f12724
b1a24f9f1eaa736e2245eef2136855a88e9a0f32
5787aabb6e5bda139378975d549351f14a2f8ce3
137aa5bdc677dab56eaa46ef65eb55c93b25a354
c63117e28473abc05f731873c79c040f27e7ac4d
8c1d298e43e38dd1c82c6d00887afe6bee645c3d
0b39498bb7200e9319602f83592fb9a3b6dd8b1c
dd747d6e5260e5d827b09bab408871dcbd2172b6
1d62a90e8af50299f577dd07609c43434116b84e
e0b32dae2c8e3862409edde944de2c00921c2d3c
2891bc69ae942535fb84233a83bf9db6ec67eef6
1da62c6d928eebfe2f7d272a06454ed279935fee
86acf5dd10a2129b0117d71a69a4f8588f8c4c99
0903d51c1114c3e8b7f2f3fab9e23ab5e1339d7d
3d51ea5e39f8fd73f9d8aa7fbd81f898faa4740b
4cc82fa159cf7849a2dc979e428178b6c6150f54
d4676d7c771053e6fabc44e220008c6a07b3627e
cacd8927569cbb10b40d754e653f5f9b4671a55c
70b8097a648a85e37e87cf3af7a13fb8fbb65fb0
1f0c7b7b002e5c03f2ad9103a75ab48c7059ccc1
886f717a09ecb136321586e2346d03b127503732
770a507c815bb766b7de2b1bf3a2a6e92cf129fd
6b3d50c76d9afe36498d4a40b9812c970a7c8531
3601e9c8015bad2c6ec5e26ca79a6b899d8f91fe
147abbc8b7670fde1932b3dbcf35e7ae17dd6f8a
dc52d813154178cdf958fc191042110ae5f398e9
c4482500b968d6b823eee5ee85f66ac93acbd1fa
26dc443b3d9559b217f36bb848d7183b68d70232
3b69a85db6219c89733df82e4f1f71597cc0d71d
bf4068e707b19f0134e76a9b6371d97741a96cc2
e4055f8a3fc06327c28e1b22b532a4eba7793860
f56f7036e92cb7c905f919c9a4429ad5e90a201f
9da84dcdd43aed44707d9db08eb92ceca232c055
3e31041a7e84ec1f4214badb2b15d79e06ef3a28
8e7c2197804f624b87f7cd625f9037ec2b2e53b1
24dcb22fc3e98f0e4eb810d506f73b0596275a72
2e1ec6842815573fd7f814151b4a10b9810cd569
1fc6b2880a925efdeaff7064e1c0de5a503615b6
3d38673a1bed5e6b428a55137a3defb5d8e26938
36d36def21ff145bc966277e2fc99043b10e2b00
7d5aaeb40759b66edea2133cb8f3a0f7037ff982
5883fdea86088bb624e8eabe2a2d615628c4f244
4c7fbec5627642402e3dd3f50ea0abe902f82c96
9ec49c45214680826e1f9957fb64a3693f67af2f
69f0e43232ade2fe225889c08454357f52ad7893
a190fde31a51b43f1ba2010fe786d435e783c6a1
c0bbc47aff669d7fec54ad43f5a6bb3bb1351d93
3fb84a98a262bdcb53f90dc5732be20185b0c727
f64bf92e075c5801cc5f82c8924d81142d17d0b3
9e41cf57199a88a9175350017942740774597110
7452f9e2d340505d54e49af597007e71d40a6f2a
dbe13ffd66888d7fc60e413c2c062c3d9c4b25d3
ffd0ec88308f44232503d3cf799d0f3dcd76b1dd
18ae7e19c81041d55219da0d6e4e6da66b22097c
6a559c7c0ac7a1070a1f836d95bc12de9cdbf0d6
8622fcb820e9f40366bcd48930a8b457df8d8671
17c35d1c4e1d7f9d44963c545911d836a356d5b5
24f58e48826f4845d7ad60e403e4fbab822320f0
fb47279af84bc57c66bec19685cc9cccfaf3589e
33b99d8c575a1300c18015d2ce2a04d86ddefe84
e096471893719c6c9ac8371cc5580c0a8be7b808
dfab92cc8b5df4a48e1f1081916b3c08f540b677
e539ad135010c9c82b9a6138c11ea2a9b3f902e8
9238d6fafc93349e07d41d4a6ad560a91bb0c37a
7e735235f47ab2bdf3de99b493e7d7957dde1164
be2703217ff767b91519871a4482f160247118b9
b0784710e17ffd9a8a53e35cc83bb15baa8213bb
1172ca7b53c21ead825f759adf95e575690eb608
5767626d89277bf4e846bf9f9bb12b680bb5b54a
399f3000653ded1be02090ac640b005adcd0439a
809e48190c2514e93cb8c97be7833ba35ffb41d9
3fc8932eca10b30c3ee17755449a87519e4fbfce
c9da6247a009a62ce1f3886a885721801e868be6
209bb5141bf075c2e554e7194158f3d7c7417365
6249467e90ace912a94560406489a0fcd69f8b08
433780d6189c18e5344cba31cf27a5608320f732
2483d24c0dbe6151ddeca1284395883fa184a08c
a8399681394c0e5773fe4939508b9dcf7077bf04
12d3771cef25ba1e8001edba703d167a294c9002
3f075a43c5738faea54fe86c79c7312250cce734
70341c310aead1c1d63068bd05fda85ae2604c41
beddbfe3871782089fbc8747d235ae53f3177fad
3332e7db5787064b2ad6dc57412fd269ff440006
ee887cd39026b57f73db319c3ec35a2fa2f3b47d
7d3cc10b998597855d6866a89dddf03e26be6411
58e9b2734e8de7760701d7652f043242d22e27c2
9eaf3939e5071fcf3d28ea025b4ce7ff558efc08
af405057579725f98a572178820018715109fc6e
13eeceafcff834ffed27ce81005ca29b320e59ce
17a279322693102bfc0477484c57e6a56dc05e25
d3cf31bbdcb622ebdd07caba4e934d75afa56d7c
a967d560e330553a30ea64023ed3f930a9684570
01e48a7f74a72f8566907a603b02a9210b808771
0cf615d17346ff0845f4be6b68f8be096573936a
8124dd6ea9d18e770b4633da14b8116c9e2b1dbf
029772752d87de1e7804756b433ae35abd458235
77831651f9d56b4203f16ef5661288a059bcfbe5
0353cf221863edb056d5b45bef1c070c1fb80994
b9ddefaa48833b7a59db846d9e46c9fa547f4bad
2a634221a9d0ca4a965008d8dcf4bbb1702a47e5
Droppers
8bf1defb2fea1880fdfb98e863276dc4cbb7a3e5
9912549c3a86e2224a5684a3c04d76bdfd2cc0a4
400138e08e0ffa1220ee19a82e5f24dd1b20868d
and
similar-to:1724942eeec7c367238409d06d6c9d39a3477998c124a2a9f6f78c425533af17
Note: Some of these droppers may deliver different payloads.
