Overview
overview
8Static
static
3SplashtopSOS.dmg
macos-10.15-amd64
7Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ...Helper
macos-10.15-amd64
1Splashtop ...Helper
macos-10.15-amd64
1Splashtop ...sTools
macos-10.15-amd64
1Splashtop ...op SOS
macos-10.15-amd64
1Splashtop ... Agent
macos-10.15-amd64
1Splashtop ...s.html
windows10-2004-x64
3Splashtop ...s.html
windows11-ltsc_2024-x64
4Splashtop ...Helper
macos-10.15-amd64
4Splashtop ...AL.htm
windows10-2004-x64
3Splashtop ...AL.htm
windows11-ltsc_2024-x64
4Splashtop ...Helper
macos-10.15-amd64
4Splashtop ...ht.ps1
windows10-2004-x64
3Splashtop ...ht.ps1
windows11-ltsc_2024-x64
8Splashtop ...ent.sh
ubuntu-18.04-amd64
Splashtop ...ent.sh
debian-9-armhf
Splashtop ...ent.sh
debian-9-mips
Splashtop ...ent.sh
debian-9-mipsel
Splashtop ...nts.sh
ubuntu-18.04-amd64
6Splashtop ...nts.sh
debian-9-armhf
6Splashtop ...nts.sh
debian-9-mips
6Splashtop ...nts.sh
debian-9-mipsel
6Splashtop ...ons.sh
ubuntu-18.04-amd64
3Splashtop ...ons.sh
debian-9-armhf
3Splashtop ...ons.sh
debian-9-mips
3Splashtop ...ons.sh
debian-9-mipsel
3Splashtop ...ent.sh
ubuntu-18.04-amd64
6Splashtop ...ent.sh
debian-9-armhf
6Analysis
- max time kernel
0s - max time network
130s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
23/06/2026, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
SplashtopSOS.dmg
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral2
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libcrypto.3.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral3
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libssl.3.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral4
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libwebsockets.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral5
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libyuv.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral6
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRFileHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRSOSHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral8
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRUtilitiesTools
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral9
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral10
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral11
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/AttendendInstallHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral14
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/SRWatchNotesHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral17
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.ps1
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral29
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral30
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral31
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral32
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
General
- Target Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
- Size 3KB
- Sample260623-alaeeshs5j
- SHA256 3b639f6434fa462861ffb85902f5f829ebce70bf010009b1e5ec3a669cb95e71
- MD5 a22ed78b094c48a69c8d521e4bad25a5
- SHA1 84564e39c18bfa1018ad6cac38be2cb59b709f23
- SHA512 e0d2c95f97001f7e201d8a991b4b35272f15face65b6876fe05db69cdeceebc62b2a3c7c75785e6536ceb7ff4cbe9f350f5939cc3c44a10164b76be7087f67d6
- TLSH T15D61DDE87254E1781146943D404B585AB3873A87D564343CF22FD95E2F58AFC32A92EF
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 1501 sudo - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/172/cmdline ps File opened for reading /proc/8/stat ps File opened for reading /proc/22/stat ps File opened for reading /proc/1148/stat ps File opened for reading /proc/1157/stat ps File opened for reading /proc/15/stat ps File opened for reading /proc/19/status ps File opened for reading /proc/453/cmdline ps File opened for reading /proc/480/cmdline ps File opened for reading /proc/906/stat ps File opened for reading /proc/1157/status ps File opened for reading /proc/157/stat ps File opened for reading /proc/700/cmdline ps File opened for reading /proc/1092/cmdline ps File opened for reading /proc/1300/status ps File opened for reading /proc/89/stat ps File opened for reading /proc/984/stat ps File opened for reading /proc/984/status ps File opened for reading /proc/1307/stat ps File opened for reading /proc/869/status ps File opened for reading /proc/1134/cmdline ps File opened for reading /proc/708/status ps File opened for reading /proc/10/cmdline ps File opened for reading /proc/18/stat ps File opened for reading /proc/168/stat ps File opened for reading /proc/496/stat ps File opened for reading /proc/700/status ps File opened for reading /proc/971/stat ps File opened for reading /proc/1062/stat ps File opened for reading /proc/1062/cmdline ps File opened for reading /proc/164/stat ps File opened for reading /proc/942/cmdline ps File opened for reading /proc/997/cmdline ps File opened for reading /proc/1134/stat ps File opened for reading /proc/1091/stat ps File opened for reading /proc/1/stat ps File opened for reading /proc/98/status ps File opened for reading /proc/539/stat ps File opened for reading /proc/1452/cmdline ps File opened for reading /proc/1249/stat ps File opened for reading /proc/78/status ps File opened for reading /proc/658/stat ps File opened for reading /proc/35/stat ps File opened for reading /proc/157/cmdline ps File opened for reading /proc/339/status ps File opened for reading /proc/901/cmdline ps File opened for reading /proc/1081/stat ps File opened for reading /proc/filesystems stat File opened for reading /proc/2/status ps File opened for reading /proc/115/status ps File opened for reading /proc/454/cmdline ps File opened for reading /proc/456/cmdline ps File opened for reading /proc/26/stat ps File opened for reading /proc/81/status ps File opened for reading /proc/173/cmdline ps File opened for reading /proc/174/status ps File opened for reading /proc/1032/status ps File opened for reading /proc/self/maps awk File opened for reading /proc/6/cmdline ps File opened for reading /proc/12/stat ps File opened for reading /proc/23/status ps File opened for reading /proc/89/status ps File opened for reading /proc/483/stat ps File opened for reading /proc/489/stat ps
Processes
-
/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"1⤵PID:1488
-
/usr/bin/dirnamedirname "/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"2⤵PID:1489
-
-
/usr/bin/basenamebasename "\"\""2⤵PID:1490
-
-
/usr/bin/awkawk -F . "{print \$1 \".\" \$2}"2⤵
- Reads runtime system information
PID:1493
-
-
/usr/bin/awkawk "{print \$1 \",\" \$2}"2⤵PID:1497
-
-
/bin/grepgrep -i "[l]oginwindow.app"2⤵PID:1496
-
-
/bin/psps -axo "pid,uid,args"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:1495
-
-
/bin/shsh2⤵PID:1499
-
/usr/bin/sudo/usr/bin/sudo -u " File: /dev/console ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 248942 Free: 248942 Available: 248942 Inodes: Total: 248942 Free: 248534" /bin/launchctl load -w3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
PID:1501
-
-
-
/usr/bin/statstat -f "%Su" /dev/console2⤵
- Reads runtime system information
PID:1500
-