2ecfb5669898ecc790bd1f72e3858739e503308071b95a4ebe993bcfb490121c

Resubmissions

08/08/2026, 16:27

260808-tx63bazhqd

08/08/2026, 16:27

260808-tx551szhqb

08/08/2026, 16:22

260808-tvb46avse17

Sharing

Copy URL Twitter E-mail

General

Target
FabFilter - Pro-Q 4 v4.01.dmg
Size 23.3MB
Sample260808-tvb46avse1
SHA256 2ecfb5669898ecc790bd1f72e3858739e503308071b95a4ebe993bcfb490121c
MD5 46132b4a3f654fc5241dd752b370dbe1
SHA1 031be8f7c41c96909f64be723a5f06f75c45764f
SHA512 579e36f9de985eb78cca3d098d455dda00b6b65e56afc17355a6a803f0089c3dfe2bc2124db6ce333d9a20b8750d7e3cbd0372c7ea1c268e15b4b999501e71a0
SSDEEP 393216:tKiFfNeDEOyuJxMrCP555/STAlcWZf4P6omlflwu+NBbkvy7ySo/d8ZWE0v+gWDW:siFFcEOycxMADkdP6odBoq7vNZWT29r0
TLSH
T141373332492A37C6DD4D243E3FE46FDBBF160E1B7E08D2C7876871259BB86106B22525
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Targets

- Target
  FabFilter - Pro-Q 4 v4.01.dmg
- Size 23.3MB
- SHA256 2ecfb5669898ecc790bd1f72e3858739e503308071b95a4ebe993bcfb490121c
- MD5 46132b4a3f654fc5241dd752b370dbe1
- SHA1 031be8f7c41c96909f64be723a5f06f75c45764f
- SHA512 579e36f9de985eb78cca3d098d455dda00b6b65e56afc17355a6a803f0089c3dfe2bc2124db6ce333d9a20b8750d7e3cbd0372c7ea1c268e15b4b999501e71a0
- SSDEEP 393216:tKiFfNeDEOyuJxMrCP555/STAlcWZf4P6omlflwu+NBbkvy7ySo/d8ZWE0v+gWDW:siFFcEOycxMADkdP6odBoq7vNZWT29r0
- TLSH
  T141373332492A37C6DD4D243E3FE46FDBBF160E1B7E08D2C7876871259BB86106B22525
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion persistence privilege_escalation
- Executes a macOS installer package script
  Adversaries use OS-specific installer packages and their resources to trigger the execution of malicious content, establishing persistence and elevating system privileges.
  persistence privilege_escalation
behavioral1
- Target
  FabFilter Pro-Q 4 v4.01 [HCiSO]/.DS_Store
- Size 8KB
- SHA256 770f0368576ef1647fc40080ca5950f29f369be1bf4a0e16882c53c6b681dc63
- MD5 a9851a7ae02852d1fc9907c0d5526bac
- SHA1 20a2cc3957ca5610e234e92c7ade3fe3cb71344f
- SHA512 36d3f8bc715845a29ddc23b152092dde4b6fdbcea9f5e8662ab5cc8a5e57571aa172149bc961bf565d28ac1f51f7e8eabb18d988d84b0321e4484fb7f0d0793f
- SSDEEP 48:DdlS5gzd5lUCr3BaFqdWun7R33BaNu770CLXkLh3+J:D7UgzlUG3BoAn7R33B4uH0gk13+
- TLSH
  T15002AF0863A5415CF57B42377AA407211766E8E1A2A88F9B4CA9019F6D32580CDB2F95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2 behavioral3
- Target
  FabFilter Pro-Q 4 v4.01 [HCiSO]/.VolumeIcon.icns
- Size 389KB
- SHA256 535bc945cd902c60eae1c1370727df90900d0bd719c4225df1e589f2109b88e0
- MD5 7875fd96f86631bcc7f666bc884cb8ce
- SHA1 27ab85d9b37ccf34e225f64b12319cddf38b50a0
- SHA512 95979595a55f32f9df856d8197cd09c59eda61703265b76c5b94f925e0edde48545906aea9d776a8005273590054046669265cd334a8df052a5ee38cca0e3f19
- SSDEEP 12288:E3TucbPUClldzJ+2VQDLwcCSFOSiOmTxZ6wR:Eq+sClldzJFQvtFfih/6wR
- TLSH
  T1EE8423853EE44EC0DC88DEFA8B89E74724151DC26A815CBCB96E3B6D3338D19D6C9487
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral4 behavioral5
- Target
  FabFilter Pro-Q 4 v4.01 [HCiSO]/.background/backgroundImage.tiff
- Size 1.3MB
- SHA256 1659fe94c68694c004e70affe654285f9910018861c2bfef7ab214d91a6aea14
- MD5 71e7b2eafdfebd57a1562c37855fb302
- SHA1 5cecd3b5354764a76c7a8aa5384813157570cb82
- SHA512 18a984606c53695a51b9848a648e1e6c9370ee92d1ebd2f5ba686609b03a68c9e6f7de8d44b68aff14576da1113d79844d3ad82336fe8ccaf32f274f1535e377
- SSDEEP 24576:bNZtoeHC5/6+CJ8QkE3fcbpQxMVQx2fLr2CPCdlaMZN:bVy/kXIGyzPTAlNn
- TLSH
  T17C5533436F60BF6CECD00ABB26A6516911A48032EF1441A5DF435F6AC5AE4CCD7B6272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6 behavioral7
- Target
  FabFilter Pro-Q 4 v4.01 [HCiSO]/FabFilter Pro-Q 4 Installer.pkg
- Size 20.8MB
- SHA256 57f9cafe3afc0a4b27e33d5fb6e89e7e9f90b0e81e9d2e377660aad0233ad49d
- MD5 114330767edaaa4adbd284ddeae0379a
- SHA1 3b235909bb5c2e38a911cf26bb703f436de14f7e
- SHA512 9ec687de735db2cb5e5dea4960aa84a2a3d7629d514c7e662d6537d5f8acfa34f07ad4c5460f32e791097af68a14e8b6e765d661912b954d54a9eb1d8e0006f7
- SSDEEP 393216:k0ckT0xTP6BdQ7we/5F8gxRrowx6XsTW9fnWfON3RyKwvSJ2iQe6Q+tKS:k0uxjyQhv8sRU8AWfOqKYSZZ+tKS
- TLSH
  T1A027339CA33F7629E4369D15D0BEA36C6E9C2430107A44674D76BD4680AE2FA50FEFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion persistence privilege_escalation
- Executes a macOS installer package script
  Adversaries use OS-specific installer packages and their resources to trigger the execution of malicious content, establishing persistence and elevating system privileges.
  persistence privilege_escalation
behavioral8
- Target
  FabFilter Pro-Q 4 v4.01 [HCiSO]/FabFilter Pro-Q 4 Installer.pkg:com.apple.lastuseddate#PS
- Size 16B
- SHA256 c488decd5739d266fe89d2d19e7717d39a046ac67974dbe51d2eba4c57ccd686
- MD5 3362e93838ab824f792350f460d67f03
- SHA1 68c218bd3520175a0d0d853eabf8d2c294d19e7f
- SHA512 3e60ac3849b5b49ac159a793adb38438fa16ac27c1763f9067a0d35c953c682fbca1e48b26282551c2810ec96200f692a1d263d8eff828645244970030dc4ea0
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral10 behavioral9
- Target
  FabFilter Pro-Q 4 v4.01 [HCiSO]/FabFilter Pro-Q 4 Installer.pkg:com.apple.quarantine
- Size 41B
- SHA256 027c177625a1549139dbb59b2f4729dca3ef68702765542996e68717025b1cd5
- MD5 9db9e380589c46649eaa01aa54de71bb
- SHA1 79cf429d3afd81cc498f6f3b72ba43e2fe58d53e
- SHA512 f9b3c6a5763bb4dc04d56019e963eceb4c02da097f912516bf247ddf66d678a34d10b52ed22065df39a1c84f291fe4abb716ceec6d0206acaf0ea8ee945f4a72
- MD5 SHA1 SHA512
Score

3^/10

execution
behavioral11 behavioral12
- Target
  FabFilter Pro-Q 4 v4.01 [HCiSO]/FabFilter Pro-Q 4 Installer.pkg:rsrc
- Size 762KB
- SHA256 c507463f5c242f91171e42797203791d4986e2d84087d63eaf765ce6d3c8d204
- MD5 c79e269596e870a5c77a1c934012ccda
- SHA1 24a213b5c3892a914d6acc0c75ae0d0e63fd50e0
- SHA512 b26c31b8c76a295ac7dca0df3e1228adc135b7b2fc2d4e6ab24a3a47e3a6a482610eda42d0b3014ae3772181c2bd88ed00a95708e2fc69fbeffd7a61fb7f4d1e
- SSDEEP 12288:uLhwxInAHmNQx7ZEeDRdxInAHmNQx7ZEeDRGrZ/KeNK+8eC2Fd6zo1IVpL2GaUTj:uLhxnAG87ZEeOnAG87ZEeSNKHeCycSIr
- TLSH
  T150F423F18055493BE69803B363569241242A1CDE74FCA9455FD2B9D3BB22FCF362E272
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral13 behavioral14

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Executes a macOS installer package script

Executes a macOS installer package script

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14