Overview
overview
4Static
static
1Farrago 2....2).dmg
macos-10.15-amd64
1Farrago 2...._store
macos-10.15-amd64
1Farrago 2....n.icns
macos-10.15-amd64
1Farrago 2....ate#ps
macos-10.15-amd64
1Farrago 2....e.macl
macos-10.15-amd64
1Farrago 2....antine
macos-10.15-amd64
1Farrago 2....bg.png
macos-10.15-amd64
1Farrago 2....ate#ps
macos-10.15-amd64
1Farrago 2....e.macl
macos-10.15-amd64
1Farrago 2....ertags
macos-10.15-amd64
1Farrago 2....antine
macos-10.15-amd64
1Farrago 2....lp.txt
macos-10.15-amd64
1Farrago 2....b7ynxa
macos-10.15-amd64
1Farrago 2....t:rsrc
macos-10.15-amd64
1Farrago 2....T].dmg
macos-10.15-amd64
1Farrago 2....es.nib
macos-10.15-amd64
4Farrago 2....es.nib
macos-10.15-amd64
4Farrago 2....am.wav
macos-10.15-amd64
4Farrago 2....adata/
macos-10.15-amd64
4Farrago 2....adata/
macos-10.15-amd64
4Farrago 2....adata/
macos-10.15-amd64
4Farrago 2....adata/
macos-10.15-amd64
4Farrago 2....il.m4a
macos-10.15-amd64
4Farrago 2....il.m4a
macos-10.15-amd64
4Farrago 2....op.svg
macos-10.15-amd64
4Farrago 2....ew.svg
macos-10.15-amd64
4Farrago 2....le.svg
macos-10.15-amd64
4Farrago 2....ervice
macos-10.15-amd64
1Farrago 2....ate#ps
macos-10.15-amd64
1Farrago 2....hgz4we
macos-10.15-amd64
1Farrago 2....y:rsrc
macos-10.15-amd64
1Analysis
- max time kernel
598s - max time network
903s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system - submitted
04/08/2026, 14:19
Static task
static1
Behavioral task
behavioral1
Sample
Farrago 2.1.5 [TNT](2).dmg
Resource
macos-20250619-en
Behavioral task
behavioral2
Sample
Farrago 2.1.5/.ds_store
Resource
macos-20250619-en
Behavioral task
behavioral3
Sample
Farrago 2.1.5/.VolumeIcon.icns
Resource
macos-20250619-en
Behavioral task
behavioral4
Sample
Farrago 2.1.5/.VolumeIcon.icns:com.apple.lastuseddate#ps
Resource
macos-20250619-en
Behavioral task
behavioral5
Sample
Farrago 2.1.5/.VolumeIcon.icns:com.apple.macl
Resource
macos-20250619-en
Behavioral task
behavioral6
Sample
Farrago 2.1.5/.VolumeIcon.icns:com.apple.quarantine
Resource
macos-20250619-en
Behavioral task
behavioral7
Sample
Farrago 2.1.5/.background/bg.png
Resource
macos-20250619-en
Behavioral task
behavioral8
Sample
Farrago 2.1.5/.background/bg.png:com.apple.lastuseddate#ps
Resource
macos-20250619-en
Behavioral task
behavioral9
Sample
Farrago 2.1.5/.background/bg.png:com.apple.macl
Resource
macos-20250619-en
Behavioral task
behavioral10
Sample
Farrago 2.1.5/.background/bg.png:com.apple.metadata__kmditemusertags
Resource
macos-20250619-en
Behavioral task
behavioral11
Sample
Farrago 2.1.5/.background/bg.png:com.apple.quarantine
Resource
macos-20250619-en
Behavioral task
behavioral12
Sample
Farrago 2.1.5/Help.txt
Resource
macos-20250619-en
Behavioral task
behavioral13
Sample
Farrago 2.1.5/Help.txt:com.apple.metadata_kmdlabel_dnftphl3a2xxyn2rmlkjb7ynxa
Resource
macos-20250619-en
Behavioral task
behavioral14
Sample
Farrago 2.1.5/Help.txt:rsrc
Resource
macos-20250619-en
Behavioral task
behavioral15
Sample
Farrago 2.1.5/Manual install/Farrago 2.1.5 [TNT].dmg
Resource
macos-20250619-en
Behavioral task
behavioral16
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/FGControllerPreferences.nib
Resource
macos-20250619-en
Behavioral task
behavioral17
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/FGPreferences.nib
Resource
macos-20250619-en
Behavioral task
behavioral18
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/ReverseScream.wav
Resource
macos-20250619-en
Behavioral task
behavioral19
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/Sample Sound Sets/Sample List Mode.farragoset/Metadata/
Resource
macos-20250619-en
Behavioral task
behavioral20
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/Sample Sound Sets/Sample List Mode.farragoset/Metadata/
Resource
macos-20250619-en
Behavioral task
behavioral21
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/Sample Sound Sets/Sample List Mode.farragoset/Metadata/
Resource
macos-20250619-en
Behavioral task
behavioral22
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/Sample Sound Sets/Sample List Mode.farragoset/Metadata/
Resource
macos-20250619-en
Behavioral task
behavioral23
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/Sample Sound Sets/Sample List Mode.farragoset/Sound Fil.m4a
Resource
macos-20250619-en
Behavioral task
behavioral24
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/Sample Sound Sets/Sample List Mode.farragoset/Sound Fil.m4a
Resource
macos-20250619-en
Behavioral task
behavioral25
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/tile-icon.loop.svg
Resource
macos-20250619-en
Behavioral task
behavioral26
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/tile-icon.preview.svg
Resource
macos-20250619-en
Behavioral task
behavioral27
Sample
Farrago 2.1.5/Farrago.app/Contents/Resources/xmark.circle.svg
Resource
macos-20250619-en
Behavioral task
behavioral28
Sample
Farrago 2.1.5/Farrago.app/Contents/XPCServices/Farrago Automation Service.xpc/Contents/MacOS/Farrago Automation Service
Resource
macos-20250619-en
Behavioral task
behavioral29
Sample
Farrago 2.1.5/Open Gatekeeper friendly:com.apple.lastuseddate#ps
Resource
macos-20250619-en
Behavioral task
behavioral30
Sample
Farrago 2.1.5/Open Gatekeeper friendly:com.apple.metadata_kmdlabel_mguxsx2wm2xfcldjqzv7hgz4we
Resource
macos-20250619-en
Behavioral task
behavioral31
Sample
Farrago 2.1.5/Open Gatekeeper friendly:rsrc
Resource
macos-20250619-en
General
- Target Farrago 2.1.5/.VolumeIcon.icns
- Size 376KB
- Sample260804-rmvkessemd
- SHA256 f0167881a1b0af33217816ca50d48345b2767bf60c9ca38826e2d8fecf9cce94
- MD5 61f79527e373ea03ca7728d05abcbd40
- SHA1 54497b3361d9cc88fdf5a84fa4319cdd89bf7cf4
- SHA512 68945ecd528a4f02949a244d5777c0eef92aca646a603a4ff509f755fb099c9ea151db78532f697d140315a62ab2e79b921b286115e2249a7bfe40cb8fd235c7
- SSDEEP 6144:lFXa4RoBgHi5NMjukHi1nMhae0QnPHRkeTcDjT+rF9bPDppHFsrf1AnNyP:lQBdMqkHi1nMMnLD0tPDPHyrf1IN
- TLSH T171841302739702A8D1CEAF7624761B40CB606EB9DF02123D58CAF439E77675C8C69BB5
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/Farrago 2.1.5/.VolumeIcon.icns\""1⤵PID:460
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/Farrago 2.1.5/.VolumeIcon.icns\""1⤵PID:460
-
/usr/bin/sudosudo /bin/zsh -c "/Users/run/Farrago 2.1.5/.VolumeIcon.icns"1⤵PID:460
-
/bin/zsh/bin/zsh -c "/Users/run/Farrago 2.1.5/.VolumeIcon.icns"2⤵PID:461
-
-
/Users/run/Farrago/Users/run/Farrago 2.1.5/.VolumeIcon.icns2⤵PID:461
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.nsurlstoraged1⤵PID:489
-
/usr/libexec/nsurlstoraged/usr/libexec/nsurlstoraged --privileged1⤵PID:489
-
/usr/libexec/xpcproxyxpcproxy com.apple.StreamingUnzipService 1951⤵PID:491
-
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService1⤵PID:491
-
/usr/libexec/xpcproxyxpcproxy com.apple.spindump1⤵PID:500
-
/usr/sbin/spindump/usr/sbin/spindump1⤵PID:500
-
/usr/libexec/xpcproxyxpcproxy com.apple.diagnosticd1⤵PID:501
-
/usr/libexec/diagnosticd/usr/libexec/diagnosticd1⤵PID:501
-
/usr/libexec/xpcproxyxpcproxy com.apple.newsyslog1⤵PID:502
-
/usr/sbin/newsyslog/usr/sbin/newsyslog1⤵PID:502