3314b23bc32b11c9033de4f7db0a44a08d46334e94608704675baed1634858b5

Analysis

max time kernel
149s
max time network
165s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
23/06/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SplashtopSOS.dmg
Size 37.1MB
Sample260623-alaeeshs5j
SHA256 3314b23bc32b11c9033de4f7db0a44a08d46334e94608704675baed1634858b5
MD5 1b07ee54de3d98a57624e330f61adf34
SHA1 76d9a29f210a45b12fc2b747e8021050d235640c
SHA512 bf9873c2736c2720a9d7bd178e6fa2de078797d68fe5c0d080b4af891f95be524e6476a6de2f1ad31f15548c1421c7af1be5e3f59669c86abc09fea539364620
SSDEEP 786432:wVTp6njAEXEZIbmzjzo4QAEskmArtxG3eG0ZnJGliG35KE+H13QMMRd7JCG:wRpIjAE0ZIyzjzo4Q3PmneG4JGoGJrOk
TLSH
T1DC8733746361055FF3D04B34856B4A802EFEECE7A6807B2B258156F29499E47BC31F3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion

Malware Config

Signatures

System Checks 1 TTPs 2 IoCs

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

defense_evasion

System Checks

T1497.001

ioc	Process
/usr/sbin/system_profiler SPHardwareDataType	Process not Found
/usr/sbin/system_profiler SPNetworkDataType -xml	Process not Found

Resource Forking 1 TTPs 4 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn launchd -s	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/Splashtop\\ SOS/Splashtop\\ SOS.app\""
1⤵
PID:514

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/Splashtop\\ SOS/Splashtop\\ SOS.app\""
1⤵
PID:514

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/Splashtop\\ SOS/Splashtop\\ SOS.app"
1⤵
PID:514
- /bin/zsh
  /bin/zsh -c "open /Volumes/Splashtop\\ SOS/Splashtop\\ SOS.app"
  2⤵
  PID:515
- /usr/bin/open
  open "/Volumes/Splashtop SOS/Splashtop SOS.app"
  2⤵
  PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:518

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:517

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.splashtop.Splashtop-SOS.2332
1⤵
PID:519

/Volumes/Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS
"/Volumes/Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS"
1⤵
PID:519

/usr/bin/bzip2
/usr/bin/bzip2 -f /var/log/wifi.log.0
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:525

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:525

/bin/sh
sh -c "/usr/bin/killall -TERM \"Splashtop SOS Agent\"; \"/Volumes/Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent\" &"
1⤵
PID:526

/bin/bash
sh -c "/usr/bin/killall -TERM \"Splashtop SOS Agent\"; \"/Volumes/Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent\" &"
1⤵
PID:526
- /usr/bin/killall
  /usr/bin/killall -TERM "Splashtop SOS Agent"
  2⤵
  PID:527
- /Volumes/Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent
  "/Volumes/Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent"
  2⤵
  PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:529

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:530

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:531

/usr/bin/codesign
/usr/bin/codesign -d --entitlements - --xml "/Volumes/Splashtop SOS/Splashtop SOS.app"
1⤵
PID:533

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.universalaccessAuthWarn
1⤵
PID:535

/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn
/System/Library/PrivateFrameworks/UniversalAccess.framework/Versions/A/Resources/universalAccessAuthWarn.app/Contents/MacOS/universalAccessAuthWarn launchd -s
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.sysextd
1⤵
PID:537

/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
1⤵
PID:537

/usr/bin/pmset
/usr/bin/pmset -g
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:540

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:540

/bin/sh
sh -c "( /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/60F8BF75-F921-4C0D-9A81-E5CD1B5DF0DD ) > \"/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/58E5EE26-1E6E-4037-A6F0-774DC63D93A3\" 2> /dev/null"
1⤵
PID:542

/bin/bash
sh -c "( /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/60F8BF75-F921-4C0D-9A81-E5CD1B5DF0DD ) > \"/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/58E5EE26-1E6E-4037-A6F0-774DC63D93A3\" 2> /dev/null"
1⤵
PID:542
- /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/60F8BF75-F921-4C0D-9A81-E5CD1B5DF0DD
  /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/60F8BF75-F921-4C0D-9A81-E5CD1B5DF0DD
  2⤵
  PID:543
- - /usr/sbin/sysctl
    sysctl -n hw.model
    3⤵
    PID:544
- - /usr/bin/stat
    /usr/bin/stat -f "%Su" /dev/console
    3⤵
    PID:545
- - /usr/sbin/sysctl
    /usr/sbin/sysctl -in hw.optional.arm64
    3⤵
    PID:552

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPHardwareDataType
1⤵
PID:547

/usr/bin/awk
/usr/bin/awk "/Serial/{print substr(\$NF,9)}"
1⤵
PID:548

/usr/sbin/lpadmin
/usr/sbin/lpadmin -x SPLASHTOP-PDF
1⤵
PID:549

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :'CPU Names'" /Users/run/Library/Preferences/com.apple.SystemProfiler.plist
1⤵
PID:554

/usr/bin/grep
grep 5PE
1⤵
PID:555

/usr/bin/uniq
uniq
1⤵
PID:556

/usr/bin/head
head -n 1
1⤵
PID:557

/usr/bin/sed
sed -n "s/.* = \$.*\$/\\1/p"
1⤵
PID:558

/usr/bin/fdesetup
/usr/bin/fdesetup status
1⤵
PID:559

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPNetworkLocationDataType -xml
1⤵
PID:560

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPNetworkDataType -xml
1⤵
PID:562

/usr/bin/fdesetup
/usr/bin/fdesetup status
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:569

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 186
1⤵
PID:572

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 509
1⤵
PID:575

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:581

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:585

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:585

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SPLOG.txt

Path /Users/Shared/SplashtopSOS/run/SPLOG.txt
Size 2KB
SHA256 3f603c1e2e22aa15afab548e25c96a4ef26d919e776ee62aaaccd6e4b8af1a53
MD5 4f5ac8c97cc8e75397cc402f36b10ab3
SHA1 16ebddfc92cff947216930cdc6b3541fbc9928f0
SHA512 c2f13716e7985f0513f2898f79392026e70464e6aca4066d6d1b651fc03b7479ffe9af7b626d02a5d9a9b4edbfe43770346856917d8f0c0cc34bb8f1b2170276
TLSH
T1DA5135641CF139D08679C850A1AB3D41E3E0B10742FAE109BE5D205467B8BAF8BAE7E5
MD5 SHA1 SHA512 TLSH

Submit Download

58E5EE26-1E6E-4037-A6F0-774DC63D93A3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/58E5EE26-1E6E-4037-A6F0-774DC63D93A3
Size 26B
SHA256 1b812d10508ccfe3edf0bbc68d4bec5a33fbe94788c20098357221596c3430ee
MD5 45d114bf62077c43c7b47093f7b30a21
SHA1 0574bb3f60eaeee56fd7d3ce14835db3d180e374
SHA512 40c417d7882b7cb1bd35cb10e0f76a3a1d00a401f6f82033872edf413b7d166888220823d7105abd16d587285f4f9e78e9b6ea4ba557c0c6d2d7cfad9ce7cddb
MD5 SHA1 SHA512

Submit Download

60F8BF75-F921-4C0D-9A81-E5CD1B5DF0DD

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/60F8BF75-F921-4C0D-9A81-E5CD1B5DF0DD
Size 1KB
SHA256 c83eaa2aa8baf316954f9a8880ae5c3d30bbbf015f3a7bf22eaebd12418bd287
MD5 6934bebd021dcc098c6b8b31ac52ea15
SHA1 8e128c4b17797c99c3eccb1354ecb71de02be47d
SHA512 5bde807b87f7ecd72bf8e3ebf066a0dbadc654432aae21f119480d94b1809e94c332249b103cb1eba8a4af1735afea35a64d0c77687bd6817cfdafa491dadc1e
TLSH
T14A213344E52E4A769D987CAE62E24E2C0581E91F0BF0BD2174FD2816F71A358B33179F
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads