Overview

overview

8

Static

static

3

SplashtopSOS.dmg

macos-10.15-amd64

7

Splashtop ....dylib

macos-10.15-amd64

1

Splashtop ....dylib

macos-10.15-amd64

1

Splashtop ....dylib

macos-10.15-amd64

1

Splashtop ....dylib

macos-10.15-amd64

1

Splashtop ...Helper

macos-10.15-amd64

1

Splashtop ...Helper

macos-10.15-amd64

1

Splashtop ...sTools

macos-10.15-amd64

1

Splashtop ...op SOS

macos-10.15-amd64

1

Splashtop ... Agent

macos-10.15-amd64

1

Splashtop ...s.html

windows10-2004-x64

3

Splashtop ...s.html

windows11-ltsc_2024-x64

4

Splashtop ...Helper

macos-10.15-amd64

4

Splashtop ...AL.htm

windows10-2004-x64

3

Splashtop ...AL.htm

windows11-ltsc_2024-x64

4

Splashtop ...Helper

macos-10.15-amd64

4

Splashtop ...ht.ps1

windows10-2004-x64

3

Splashtop ...ht.ps1

windows11-ltsc_2024-x64

8

Splashtop ...ent.sh

ubuntu-18.04-amd64

Splashtop ...ent.sh

debian-9-armhf

Splashtop ...ent.sh

debian-9-mips

Splashtop ...ent.sh

debian-9-mipsel

Splashtop ...nts.sh

ubuntu-18.04-amd64

6

Splashtop ...nts.sh

debian-9-armhf

6

Splashtop ...nts.sh

debian-9-mips

6

Splashtop ...nts.sh

debian-9-mipsel

6

Splashtop ...ons.sh

ubuntu-18.04-amd64

3

Splashtop ...ons.sh

debian-9-armhf

3

Splashtop ...ons.sh

debian-9-mips

3

Splashtop ...ons.sh

debian-9-mipsel

3

Splashtop ...ent.sh

ubuntu-18.04-amd64

6

Splashtop ...ent.sh

debian-9-armhf

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    SplashtopSOS.dmg
  • Size 37.1MB
  • Sample260623-alaeeshs5j
  • SHA256 3314b23bc32b11c9033de4f7db0a44a08d46334e94608704675baed1634858b5
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutionlinuxmacospersistenceprivilege_escalationransomwarespyware

Malware Config

Targets

    • Target
      SplashtopSOS.dmg
    • Size 37.1MB
    • SHA256 3314b23bc32b11c9033de4f7db0a44a08d46334e94608704675baed1634858b5
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasion

    • System Checks

      Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

      defense_evasion
    behavioral1
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libcrypto.3.dylib
    • Size 9.2MB
    • SHA256 c612685c3c9c948b92fd3bbbf49e6d7fe3d4d8ee05adda5ec3aae2f1c55a3b74
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libssl.3.dylib
    • Size 2.0MB
    • SHA256 cb2cf13fc78ae87d675a0f493384d942e295377d774ff65cb873bf9e739ca81e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libwebsockets.dylib
    • Size 355KB
    • SHA256 01d46590f11bd39d73bc52406b97a3876fa6eb62d3aee0b1553300d72e2ca3d9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libyuv.dylib
    • Size 951KB
    • SHA256 d6e2c522dd610efb54f506d7f135773fdc2b4217fdbf2f8c27be1c303cab5195
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRFileHelper
    • Size 289KB
    • SHA256 aa01a23c1300fc686a4852e962781bb3300ff684b9b8d339decea91debf53d44
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRSOSHelper
    • Size 202KB
    • SHA256 8db2fa304fadfe1cc8aac3c77299c8b879bfd1ffed5d85ee1c303d6aea386a2c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRUtilitiesTools
    • Size 138KB
    • SHA256 768cc5c627f28d0a89612b529108e1fa17f40476eb93d4d1bbf6b5b57525ad4d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS
    • Size 7.1MB
    • SHA256 14e8c566e465a0bc7a2a1ce6dce2010a182e536b47ef0c5e8d46f0c76ead31ef
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent
    • Size 4.4MB
    • SHA256 e24e6ec75497f3600b0561cf88477e54c8ce5c1f4258e16803b1d5dcfba9b4c2
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
    • Size 122KB
    • SHA256 2cdfd760947e739a67dea9fd688eb384d4ebf1f1930fea5aabb0f6cff1a66198
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral11behavioral12
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/AttendendInstallHelper
    • Size 202KB
    • SHA256 14531237c8a22fcc1325920a8fe9dad1137a2dac45ec1f91d3c7b3895bf7c1cd
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    defense_evasion
    behavioral13
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
    • Size 79KB
    • SHA256 3fcdf340a6e24084938317e4fd57fc1d7c321f711f6ddba7876f6987e6f7a54b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    discovery
    behavioral14behavioral15
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/SRWatchNotesHelper
    • Size 133KB
    • SHA256 b8029acdeea235fb3a8d6777ce42306e630eaa5e158038f48d608215e3590978
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    defense_evasion
    behavioral16
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.tiff
    • Size 8KB
    • SHA256 05ba7d6945762765e6f8ae39661b9281f292784b8c7a78f0525464e41311ad61
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    executionadwarepersistenceransomwarespyware

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral17behavioral18
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
    • Size 4KB
    • SHA256 3285c22e7bc7460709dbef54d7e0e0156c834421b8d2e4527fa7c8e989783e92
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoveryprivilege_escalation
    behavioral19behavioral20behavioral21behavioral22
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
    • Size 3KB
    • SHA256 3b639f6434fa462861ffb85902f5f829ebce70bf010009b1e5ec3a669cb95e71
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    defense_evasiondiscoveryprivilege_escalation

    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching

      Abuse sudo or cached sudo credentials to execute code.

      privilege_escalationdefense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral23behavioral24behavioral25behavioral26
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
    • Size 4KB
    • SHA256 532c974d60a3bed348ea60b81d939c5700667a6592150e42018b55737f9b6438
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28behavioral29behavioral30
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
    • Size 913B
    • SHA256 f2914ed62297e8682fff44768166e60312fc2fa61a62eb0199e6991d067991d6
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    defense_evasiondiscoveryprivilege_escalation
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Boot or Logon Autostart Execution

1
T1547

Active Setup

1
T1547.014

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Hide Artifacts

1
T1564

Resource Forking

1
T1564.009

Modify Registry

2
T1112

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Discovery

Browser Information Discovery

1
T1217

Peripheral Device Discovery

2
T1120

Query Registry

5
T1012

System Information Discovery

6
T1082

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasion
Score
7/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
4/10

behavioral13

defense_evasion
Score
4/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
4/10

behavioral16

defense_evasion
Score
4/10

behavioral17

execution
Score
3/10

behavioral18

adwareexecutionpersistenceransomwarespyware
Score
8/10

behavioral19

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral20

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral21

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral22

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral23

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral24

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral25

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral26

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral32

defense_evasiondiscoveryprivilege_escalation
Score
6/10