ebad4e76f0a88941f1628d2c4cc6365ec769a8e52046911a3618e0f34661748c

Sharing

Copy URL Twitter E-mail

General

Target
Farrago 2.1.5 [TNT](2).dmg
Size 46.5MB
Sample260804-rpb6vsgm5w
SHA256 ebad4e76f0a88941f1628d2c4cc6365ec769a8e52046911a3618e0f34661748c
MD5 ee2cb95f8129f1341005bb5538464c2d
SHA1 852c72ba39ac269a1e2201ba0b53d6b6f845b5eb
SHA512 503ba7e499e5db375e45f14d50c245cfd9d4286f7048e54b1a66f63af582097a8a5c945d725d8155a1aaff0c26fa1172a24add9c1dae9c0d54be3c4acb4452d4
SSDEEP 786432:7tYzRBJpzsJS4DVy+fO/vaKuBFf2d1C9TrlbGl7Q4GgMSIUf1kctyOc4ZtQU2oE:7QbJpzsJS4qmBFff9TrytGaDf1hc4Ztw
TLSH
T162B73333AB21DB14E10F6B3C0BED9761BE718D33A741417684117F9127B6AEC8A563E8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  Farrago 2.1.5 [TNT](2).dmg
- Size 46.5MB
- SHA256 ebad4e76f0a88941f1628d2c4cc6365ec769a8e52046911a3618e0f34661748c
- MD5 ee2cb95f8129f1341005bb5538464c2d
- SHA1 852c72ba39ac269a1e2201ba0b53d6b6f845b5eb
- SHA512 503ba7e499e5db375e45f14d50c245cfd9d4286f7048e54b1a66f63af582097a8a5c945d725d8155a1aaff0c26fa1172a24add9c1dae9c0d54be3c4acb4452d4
- SSDEEP 786432:7tYzRBJpzsJS4DVy+fO/vaKuBFf2d1C9TrlbGl7Q4GgMSIUf1kctyOc4ZtQU2oE:7QbJpzsJS4qmBFff9TrytGaDf1hc4Ztw
- TLSH
  T162B73333AB21DB14E10F6B3C0BED9761BE718D33A741417684117F9127B6AEC8A563E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  Farrago 2.1.5/Manual install/Farrago 2.1.5 [TNT].dmg
- Size 43.3MB
- SHA256 d08fb3197f2279c0ffe3f23afe3f4f0fb5fa12dd42b46209b5f4793a3719ef53
- MD5 be0524ffed29662c9071728c5c96eefa
- SHA1 5173b56a141d1a1d5a595d70570b7f2be36ce247
- SHA512 5554309b16b8ae34c79f97c85e99d8787f40582b937de5155f4988aa4d5d020fe3dde3606c88126bfe6f3c3234ac9cb925dd8086f853565124892bb00737bd4e
- SSDEEP 786432:jYzRBJpzsJS4DVy+fO/vaKuBFf2d1C9TrlbGl7Q4GgMSIUf1kctyOc4ZtQU2o:ObJpzsJS4qmBFff9TrytGaDf1hc4Zt7
- TLSH
  T17AA73333AB71DB14E11F2A3C4BDED7657E718923A345817684113F8227B2AEC86573E8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  Farrago 2.1.5/Farrago.app/Contents/Frameworks/libFLAC.dylib
- Size 649KB
- SHA256 2d5b70dde697d5cc2dac125a8b189a77de52d89c9d02449a39511179016c898c
- MD5 7998935d86a0ba5d93ed0bd7390faa45
- SHA1 e7d5261cff870c6fa1491abfb6b3fa29dd19ebed
- SHA512 50382a6f44552204feee46fe0f077addc84af9de5f79d470bcb442c9a59ce895d3929f800bb7124b70abc23b35db7fce8593f63b0240367587e8c2f3f725cfb7
- SSDEEP 6144:a7Q9pyJj+MtpSBoqeYrH1wxl660ORAnlGsX8EmZSW+noUmbzzO2yuN4aLzZhfA/c:OQSjGS6H1lROS7oUmlDuc
- TLSH
  T146E4BF4DEF2A6C2ADAC6E07857EF8B42B437F250471C89A374E1A0347D96FD07516B22
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  Farrago 2.1.5/Farrago.app/Contents/Frameworks/libavcodec.dylib
- Size 2.8MB
- SHA256 26a81c7b6326ea88e1cedd1417085ccd36a953ec75e12fe2293b29cd397c37c8
- MD5 35914a87d7648b4b451cfba2b3c02f44
- SHA1 f83e66c29f598f0abe5756d34459765914722b89
- SHA512 09ba5296a00fc6db968657f14b0a8f605913977376bee0ff139b8888ae1a4480b1c953b030e1ca8c632b38858b927d3e73446e8936a1a3869e81c3e7d8d831a8
- SSDEEP 49152:Gu3FLu3RKXKdQfFqznFyIx+yxHvkSXMKqrHiHMywmkLDwT2KuniHbU+XPuqjX/Pa:GuyRrI4znFyk5vb8k1wmrTbzfF9wv
- TLSH
  T1F5D5D003F9569A6AD7CDA234919A9F13F53ABC4005601A7736B0FB3C7DB6BE01A07748
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  Farrago 2.1.5/Farrago.app/Contents/Frameworks/libavformat.dylib
- Size 983KB
- SHA256 aacfe34785ea1c8f15335ab22620a0014e1a5996b28fdc6bbff19ccf5ed1fc41
- MD5 6e0925c2b95edf0ae9847dfa4e4d6afd
- SHA1 95c5f816114ac18f7dba700479aa54113a7da095
- SHA512 9c3279f3a2e62245cda57c28dfea54cad7b752fd5a55fa1cfc592a9dba426feb6a3de260b90de29545525f93e4bb6bb332141f89b1f7f735272ac247a0eea7e8
- SSDEEP 12288:FILCQaPxFDKaWLoJ0Gyrn1YRsEXfg5kzOllAIKoPcvJzXmEbImD:FoFaPz2aBpy1GsF/2ZXmw
- TLSH
  T11525AE42EE9D2C2ECBC6D13D865D8B22723BF85405209BB73A40E72C7D56FD0B629B15
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  Farrago 2.1.5/Farrago.app/Contents/Frameworks/libavutil.dylib
- Size 694KB
- SHA256 ae2a68271d032bb2219495e0b8ebb07016e8621fb6f2cc79a3b7271633002c06
- MD5 299b087990f715f446655755d89f2fd0
- SHA1 a9b3e3407bcf5013fac062c78986203f28d71ca9
- SHA512 2a83319a40d7d5737a7c31f7c0d754481b36dcac87dbb7dd8eda39b332dd7087b13454fe4eb140f23003c507c05f7146f49ac8b6323a0a3b896ca64f4c527314
- SSDEEP 12288:yhTGFB4BUcXgruvw8T/3ub4R2Hf+3hDFCujjUDIPlTl61NxrfOHbP31kBHw0Cq+t:gTGFB4BUcXgrz8D3E4kHcR3nlpcrKP1n
- TLSH
  T1CEE4BF43BD482C2FCAC6F535E84D8763A637B4610721DA5B7790EBB83C237907926B25
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  Farrago 2.1.5/Farrago.app/Contents/Frameworks/libmp3lame.dylib
- Size 612KB
- SHA256 58f95e56bc2a1c3c5dddd0ac7c69cf7e649411c1b8c7841656bae3aba6649330
- MD5 90178840b5de952ffccf31f5cb04298e
- SHA1 de4273385f7ef9506e8e1ecabf66aca8cadefaa4
- SHA512 8d930894b2ddf5659d2eeab96ca5135d49fb6df8f5671b002c83dbda04b04d7904d4ce508a07df127f1086866c924816300f59406eb90524100d0a661908ff2d
- SSDEEP 12288:lmkJS3Fu6n2ikM8a6dZAz917+ZzBYAeL+R/NasduC9:0n2ikJa6dZAJgZS+hNasduC
- TLSH
  T18AD4BF0AFD59AC6AC6C2903982575713B633F4700310DE9BB7C0D97C2E926A527BB739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  Farrago 2.1.5/Farrago.app/Contents/Frameworks/libswift_Concurrency.dylib
- Size 1.1MB
- SHA256 3d17b20808903e6a10e09036f43325533cd665fee01f8d3f487ca4ced5685bf8
- MD5 6e519728503a88d3eebf57fb115b645f
- SHA1 ca56f0bfa80d74f4e15994f1357ffebb0d1a0462
- SHA512 eb93d324efaec9c19b9abc09a68b3ede6041594c2536a44dfe980846f2b5397cddd08fdbb1e5b663e7c881ad23e1187ca31e2369324951fea91e5f2df6c1bf13
- SSDEEP 24576:SJwMsIQ+ksHpHQpxEQvSVIMNItdKLkuwu:SJbkmKKLXv
- TLSH
  T1CE358D66E69F0D10C5DDB3F9D5B24211333BF84463487D7A32ACE468FCA7A81C91A279
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  Farrago 2.1.5/Farrago.app/Contents/Frameworks/libswresample.dylib
- Size 268KB
- SHA256 cb690c2d9e1319d53581eb07fdbc7034b3001b8afbcac96ddae2783450f17a95
- MD5 64ae3ae47a92102a449c5ac297869b17
- SHA1 c4c469f3258559c6297e0aafa91faff721201404
- SHA512 26f96beeb5f577a3ee2d56039dfa0f802e638bf912a66a546e942a05b32d0e0caca617af6dabca3f5f9c75c0a1ab050e040a59ee3f8df2e41eb5af94b9c283aa
- SSDEEP 3072:3pDni+A141O8LK9Ft8ONuOOTAQ44zc9FtFRfBAl:3pi9Ft8KuOg49Ft/f+
- TLSH
  T119448F46FA89245CC696913439BDDF936725B4B01E940B327B90D7FC2FE1A602F02F66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  Farrago 2.1.5/Farrago.app/Contents/MacOS/Farrago
- Size 7.4MB
- SHA256 a1361c52302f3c17c4fdb8de8e931129ae6819950b6b372718a423a71c398fa8
- MD5 a6a95e836cd871245a1050d1347cddbb
- SHA1 855171c3da831f394228a3fa0446cf2822093a19
- SHA512 6a61dbbfdecba9106c836b503302f8f313d7328b33df0f2eaa3095ed9ea9dc92c932a75c21fee963e708ef5fc20030788d8e669032292c445d5648cc751b37a1
- SSDEEP 49152:ZrxoLx0z+SS/k58jy4V/KJYdq0C3RdCkaj6sNngMaxGbSh8rInfZIjH+aIvf2iEo:0A8kauUfioYgG+rvlGqm8Y9
- TLSH
  T120766C1B013E1C2CC1C1F27C0D5F5BB36612F9A55622F25A3D769638AFA6DD2032973A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/English.lproj/About/images/bg.svg
- Size 51KB
- SHA256 a0059905aa0fb01b1544f517c61b98c63ef61dc190f4426f2c0d4ab36f3a5ef1
- MD5 bd42b9b5f0acde5f09458f01b4461869
- SHA1 cfd7eb49cc1a181f7c69141907a82e0e67ffbaf2
- SHA512 6b5d0ef65f92591f9926d37c419566075548b9d6fdbb2dd1da4f8d724281842a14fe5dddb205c68f8c1754ff27b1137b0e2feb638250dadf7fceeced49485e59
- SSDEEP 1536:WWaGRsqqFcs0apbcs0apZcs0apFcs0apScs0apscs0apwpQqqFcs0apbcs0apZcy:d1K
- TLSH
  T17833C65773480CD4D919C7B37DDA59B0361EF0E79A1AB08C25E9AD0CDA2F076DB3884A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral11 behavioral12
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/English.lproj/About/images/icon-copy.svg
- Size 692B
- SHA256 4680d080de2734378eec0f69d895307f48c31e629001963e838090e5ea3a2cde
- MD5 2d8f9d8e6ab50105857de7442d71c277
- SHA1 e51b0998531c0f6107898328b5ed139ef83a667a
- SHA512 c12900ae589b300660a774288cfe2f3a2cafc791be495cbaa1b070d1a061118b0428baebb6e5dfb59b2cba9e2c3b64a884e96f0c6b99d635dc36184260429799
- TLSH
  T1DA0110E9D31AC221540C92839FE59D5357ECF1CAD24907647009E5DB42C3283542D704
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13 behavioral14
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/English.lproj/About/images/ra-logo.svg
- Size 24KB
- SHA256 3936ecc0c36029a2d64ff8ca6e8862fb30354063067f26710c236c9bf56c0e0c
- MD5 abe62e114c68465922823db4c55114ac
- SHA1 538711288736b4e046826f49e844c51cf74a4213
- SHA512 e703f3beb2bdf12bdade4df4600b9041b838a490740542af3e16e66812c265fed04fcfb3ec7e7e5508e72346d0de6d0e147132da2208e5d6721adb89ecdeffbf
- SSDEEP 768:plH2tffZf3AyFeKIFmGILoMIdd5sIsYicV87MZrz:OnFzjfBmLF87Sz
- TLSH
  T168B2A5D20324D14E5C8A9A5DFF3540E7231F703BFB5A648A99DF8F29A9B7682D443C48
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral15 behavioral16
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/English.lproj/About/index.html
- Size 3KB
- SHA256 a1297efcfc684ed4465d338cb35050711d66000a89ef16944ff94d2408a02e6b
- MD5 5ccbd67db9772c9aa8ddbdf6068995ed
- SHA1 f03dcfaec875d72e855fa7a7c9bd4f875086cced
- SHA512 2fdd2c002b9e01cd3c1ca9dd4c6b870af495e9160b31cb2cd63b52ca9ee726713fdef4983dd77e85e5867a79b88b4414ab62d9655e99f08b332912cee94d19c5
- TLSH
  T1CE51F1A051CE2C3B820123D1B0615B89A9CF7EB5E2A25090F2BB0576E3C6D40F4265A7
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral17 behavioral18
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/English.lproj/Tour/images/bg.svg
- Size 42KB
- SHA256 d7a3b715649010ae31c7c77f35335ca0b2c519bc478c185263abfcf0bf7e3f3d
- MD5 18b7e99317887b986e95f2ed7a61357f
- SHA1 737e1008b000cd818cc128088ef4a1aa59ff10f3
- SHA512 7f4fe430b3466761fc65f911eba2e1424bcad4214dcf7f0c3cc124caa6c156a43faa80194fe41cfffab612048998cda0516e74bda34c02f4709d48288de330ee
- SSDEEP 768:o5tdLI1beJI11beJIv6X6EktTc6X6EktTk5teLW1beJI51beJIp6X6EktTs:KLI1beJu1beJ26X6EktY6X6EktTLW1b8
- TLSH
  T15813F9F4524091A1960FC7814FD5AE72475DF0E8EB9F120C3074A36A99DB9DB7A2CF80
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

adware discovery spyware
behavioral19 behavioral20
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/English.lproj/Tour/notices/controllers.html
- Size 1KB
- SHA256 f3adcc828a988631c3a4cb89d8eb49c6beaac59d1a75bd0748520d32952ac0e3
- MD5 2e87655de1e216fef194a146fede9735
- SHA1 4705b4bd5bd5e0b1397948d9ae3242d84479df6e
- SHA512 32eeae364bd7942c2a255ba2bca999d0477cdbc8de8dd53649ec3de9fe91065661c321522f94585e10f3e143213dc2d4f4ae6fc092b56666f904d34b4d9d7199
- TLSH
  T1F7414485DB8D1AAF127F21E4D53753E5B24F007B8560CFF93CB89024F089CA6026ADD5
- MD5 SHA1 SHA512 TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/com.rogueamoeba.farragostreamdeck.sdPlugin/farragostreamdeck
- Size 257KB
- SHA256 6e67c744bd8ab09caec9cbda83e37cd2165a51158751a19839b890c8b50f5bdd
- MD5 d69fe9a5c6ec86c2f1dec20693735f3d
- SHA1 bccf61c0eedbbc9a6dffbfb47618a12367f42955
- SHA512 032339ba80574ba73f5b6f093ba0ff07d0e44b1f5bb437e8503da01b706ceaf5995d17a8fcdbd549f1752ed34b2e4a0fa6e1df96e7b5ea6d79aad4b490ea10b0
- SSDEEP 3072:oCvWbZtRn1O2IFefSGMOICp+IRWbZiFaOITEB533kYPE+I1cg:5ubnIFefSGBICp7yZwIAj3JPEbc
- TLSH
  T1E9445C2337180807C55DA03D9E6E4782333AFBA559F0E77E0D68E1092FE6BC5523A5DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral23
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/com.rogueamoeba.farragostreamdeck.sdPlugin/propertyinspector/css/caret.svg
- Size 171B
- SHA256 40a4b4cbfd029b639fbf28ff33b49f18130f53cffef4e0eb870e01f2d13b5b04
- MD5 92c2fb0a20000397ab1277e1e71ac514
- SHA1 5776e118c959187f2591597a112bbe6b825c03eb
- SHA512 421c416d05637926881ae37204bf8b3134377ce48afc530ed25fb1cde62193abf7a8657d621c10842166853f09f956164acaecad23efa288ae3c17602f15b4dc
- TLSH
  T1A9C08075989C9C5DC45740F4556571C5209BD08152440056D28D3EB16007DD2BD131ED
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral24 behavioral25
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/com.rogueamoeba.farragostreamdeck.sdPlugin/propertyinspector/css/check.svg
- Size 210B
- SHA256 335209a5e56c21e31a9b3a119fa2370facd178283557f2ae6fa9f06e848c368c
- MD5 c696e73902035e125e8bc3fa0f05eba4
- SHA1 dd08a394dc0b7a3bb125696aac8d8d47c52942cb
- SHA512 fab1a444f9c0e50632516d887f29695d658a8e65bc04dc6a3f767f3ccfb1ab88f429b8a4d961942926c98c9080fe0306b7d3c955d877091a78b687393a8f4c4f
- TLSH
  T1FDD023DCA44C8834C684587448A55F7470DEE85151DC0167F3C8287111335C6D77157C
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral26 behavioral27
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/com.rogueamoeba.farragostreamdeck.sdPlugin/propertyinspector/css/elg_calendar.svg
- Size 1KB
- SHA256 f11a7b1eaf040f2513593c81f9695e7aa5ca907d44a45a19f8d6dca67075b66d
- MD5 dba0ca77b62be0faad2efd40eca0f080
- SHA1 522ecd18454ac9dbcf6dc8378d32793d4f5ef167
- SHA512 b37ef90a39535a6cf5654593e04fa548faf623c05c1118b89d2e8654f32558aa51d6b133f1d5e99d3710779f50e6df94380ab6586dbb125f6ffec335dcde7cfa
- TLSH
  T10521AD91BCA5554CEB101B2E460814DB382FE0D743195041BE5CB67A3BAC6EBEDE127D
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral28 behavioral29
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/com.rogueamoeba.farragostreamdeck.sdPlugin/propertyinspector/css/elg_calendar_inv.svg
- Size 764B
- SHA256 2c8f4decb363794fa8dd4369c98f764e313748fa5f89f03b5e3bad8b391eb778
- MD5 1ccf624ea630661250fed98d68a9d91d
- SHA1 533721d69d7a88f989c14f5ef63af6638878d338
- SHA512 6db35e4c3de03bd68cfdbdb26bb8b808bc2f10853ebd8dd9933e38bab23557d3ad01dafeb0609b2095442ba0c8c50b2ae2b79c8eec0d12622d17ac83e1895735
- TLSH
  T14B016D8D90414B84DE0819300C0E8186367EB062BE93C1A4FCF62245FC1ED6DFA71978
- MD5 SHA1 SHA512 TLSH
Score

7^/10

adware discovery spyware
- Loads dropped DLL
behavioral30 behavioral31
- Target
  Farrago 2.1.5/Farrago.app/Contents/Resources/com.rogueamoeba.farragostreamdeck.sdPlugin/propertyinspector/css/g_d8d8d8.svg
- Size 3KB
- SHA256 f57885a426e1e665cc666eb2a29aff9419edb79dd61292c9db07119ea8106ca9
- MD5 99c8501ffd475fa89756c7c83d72b7f6
- SHA1 2ce2ba546548859bc127093e3bc6584959921b0a
- SHA512 47a82cc8a4ffc52cc73c5db04b1c6bd0449c92bfbbb2855369c91874b1f0b309c9595eb33268f80268dade903a7d62ee0d105f3256cb8c8fe0c76a514a815b4e
- TLSH
  T16E6162E69355967DF3820A2E5881082538FA31A4B852DEDCF4CF801AFC61CD89DBE617
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

Loads dropped DLL

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32