3285c22e7bc7460709dbef54d7e0e0156c834421b8d2e4527fa7c8e989783e92

Analysis

max time kernel
1s
max time network
6s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20260513-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
23/06/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Size 4KB
Sample260623-alaeeshs5j
SHA256 3285c22e7bc7460709dbef54d7e0e0156c834421b8d2e4527fa7c8e989783e92
MD5 f1c22cb75867b76965b4f2fe3bfcc2e9
SHA1 88d7ccac56797f98b7525d3e791c02e07efeef65
SHA512 3c41bda44dc098c2fbee5410858c9d6718057adc0b06fd73b0f21e206f5c95032fb36d57a4ddda855cfc9d85cba37d8544318e7310a0214ffbd07dd303c09a86
SSDEEP 96:bvVxZ1eFoqaKN7Y2D7BwpdpYb/DEMDp0C1MT:bvVxPDqbN7Yc7BwpdpOj0CQ
TLSH
T10691546424405DB42B87853D5A0B9623B3EC110FC0DA581CFB5FE1253F79AE896E91FB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 7 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
1492	sudo
1494	sudo
1496	sudo
1499	sudo
1501	sudo
1506	sudo
1518	sudo

Enumerates kernel/hardware configuration 1 TTPs 1 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/kernel/kexec_loaded	shutdown

Reads runtime system information 38 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	cp
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/osrelease	shutdown
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/stat	shutdown
File opened for reading	/proc/1/environ	shutdown
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/filesystems	shutdown
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/1/sched	shutdown
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/maps	awk
File opened for reading	/proc/cmdline	shutdown

/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
"/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh"
1⤵
PID:1491
- /usr/bin/sudo
  sudo cp -rf "/Users/Shared/Splashtop SOS Agent/Splashtop SOS.app/Contents/Resources/com.splashtop.sos.plist" /Library/LaunchAgents
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1492
- - /bin/cp
    cp -rf "/Users/Shared/Splashtop SOS Agent/Splashtop SOS.app/Contents/Resources/com.splashtop.sos.plist" /Library/LaunchAgents
    3⤵
    - Reads runtime system information
    PID:1493
- /usr/bin/sudo
  sudo cp -rf "/Users/Shared/Splashtop SOS Agent/Splashtop SOS.app/Contents/Resources/com.splashtop.sos-agent.plist" /Library/LaunchDaemons
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1494
- - /bin/cp
    cp -rf "/Users/Shared/Splashtop SOS Agent/Splashtop SOS.app/Contents/Resources/com.splashtop.sos-agent.plist" /Library/LaunchDaemons
    3⤵
    - Reads runtime system information
    PID:1495
- /usr/bin/sudo
  sudo chown root:wheel /Library/LaunchAgents/com.splashtop.sos.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1496
- - /bin/chown
    chown root:wheel /Library/LaunchAgents/com.splashtop.sos.plist
    3⤵
    PID:1497
- /usr/bin/sudo
  sudo chmod 644 /Library/LaunchAgents/com.splashtop.sos.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1499
- - /bin/chmod
    chmod 644 /Library/LaunchAgents/com.splashtop.sos.plist
    3⤵
    PID:1500
- /usr/bin/sudo
  sudo chown root:wheel /Library/LaunchDaemons/com.splashtop.sos-agent.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1501
- - /bin/chown
    chown root:wheel /Library/LaunchDaemons/com.splashtop.sos-agent.plist
    3⤵
    PID:1504
- /usr/bin/sudo
  sudo chmod 644 /Library/LaunchDaemons/com.splashtop.sos-agent.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1506
- - /bin/chmod
    chmod 644 /Library/LaunchDaemons/com.splashtop.sos-agent.plist
    3⤵
    PID:1507
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:1508
- /usr/bin/awk
  awk -F . "{print \$1 \".\" \$2}"
  2⤵
  - Reads runtime system information
  PID:1511
- /bin/grep
  grep "FileVault is On."
  2⤵
  PID:1515
- /bin/sleep
  sleep 1
  2⤵
  PID:1517
- /usr/bin/sudo
  sudo shutdown -r now
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:1518
- - /sbin/shutdown
    shutdown -r now
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:1519

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads