Overview
overview
8Static
static
3SplashtopSOS.dmg
macos-10.15-amd64
7Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ...Helper
macos-10.15-amd64
1Splashtop ...Helper
macos-10.15-amd64
1Splashtop ...sTools
macos-10.15-amd64
1Splashtop ...op SOS
macos-10.15-amd64
1Splashtop ... Agent
macos-10.15-amd64
1Splashtop ...s.html
windows10-2004-x64
3Splashtop ...s.html
windows11-ltsc_2024-x64
4Splashtop ...Helper
macos-10.15-amd64
4Splashtop ...AL.htm
windows10-2004-x64
3Splashtop ...AL.htm
windows11-ltsc_2024-x64
4Splashtop ...Helper
macos-10.15-amd64
4Splashtop ...ht.ps1
windows10-2004-x64
3Splashtop ...ht.ps1
windows11-ltsc_2024-x64
8Splashtop ...ent.sh
ubuntu-18.04-amd64
Splashtop ...ent.sh
debian-9-armhf
Splashtop ...ent.sh
debian-9-mips
Splashtop ...ent.sh
debian-9-mipsel
Splashtop ...nts.sh
ubuntu-18.04-amd64
6Splashtop ...nts.sh
debian-9-armhf
6Splashtop ...nts.sh
debian-9-mips
6Splashtop ...nts.sh
debian-9-mipsel
6Splashtop ...ons.sh
ubuntu-18.04-amd64
3Splashtop ...ons.sh
debian-9-armhf
3Splashtop ...ons.sh
debian-9-mips
3Splashtop ...ons.sh
debian-9-mipsel
3Splashtop ...ent.sh
ubuntu-18.04-amd64
6Splashtop ...ent.sh
debian-9-armhf
6Analysis
- max time kernel
1s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem - submitted
23/06/2026, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
SplashtopSOS.dmg
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral2
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libcrypto.3.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral3
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libssl.3.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral4
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libwebsockets.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral5
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libyuv.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral6
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRFileHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRSOSHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral8
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRUtilitiesTools
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral9
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral10
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral11
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/AttendendInstallHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral14
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/SRWatchNotesHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral17
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.ps1
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral29
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral30
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral31
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral32
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
General
- Target Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
- Size 3KB
- Sample260623-alaeeshs5j
- SHA256 3b639f6434fa462861ffb85902f5f829ebce70bf010009b1e5ec3a669cb95e71
- MD5 a22ed78b094c48a69c8d521e4bad25a5
- SHA1 84564e39c18bfa1018ad6cac38be2cb59b709f23
- SHA512 e0d2c95f97001f7e201d8a991b4b35272f15face65b6876fe05db69cdeceebc62b2a3c7c75785e6536ceb7ff4cbe9f350f5939cc3c44a10164b76be7087f67d6
- TLSH T15D61DDE87254E1781146943D404B585AB3873A87D564343CF22FD95E2F58AFC32A92EF
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 725 sudo - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/21/status ps File opened for reading /proc/23/stat ps File opened for reading /proc/29/cmdline ps File opened for reading /proc/41/stat ps File opened for reading /proc/718/status ps File opened for reading /proc/6/status ps File opened for reading /proc/27/stat ps File opened for reading /proc/42/stat ps File opened for reading /proc/319/stat ps File opened for reading /proc/719/cmdline ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/10/cmdline ps File opened for reading /proc/14/status ps File opened for reading /proc/22/status ps File opened for reading /proc/105/stat ps File opened for reading /proc/75/status ps File opened for reading /proc/298/status ps File opened for reading /proc/715/status ps File opened for reading /proc/719/stat ps File opened for reading /proc/108/stat ps File opened for reading /proc/108/cmdline ps File opened for reading /proc/277/cmdline ps File opened for reading /proc/572/cmdline ps File opened for reading /proc/5/cmdline ps File opened for reading /proc/7/cmdline ps File opened for reading /proc/10/status ps File opened for reading /proc/298/cmdline ps File opened for reading /proc/138/status ps File opened for reading /proc/271/status ps File opened for reading /proc/26/status ps File opened for reading /proc/13/cmdline ps File opened for reading /proc/690/cmdline ps File opened for reading /proc/17/status ps File opened for reading /proc/42/cmdline ps File opened for reading /proc/294/cmdline ps File opened for reading /proc/298/stat ps File opened for reading /proc/319/status ps File opened for reading /proc/564/status ps File opened for reading /proc/715/stat ps File opened for reading /proc/153/status ps File opened for reading /proc/294/stat ps File opened for reading /proc/2/status ps File opened for reading /proc/self/maps awk File opened for reading /proc/15/stat ps File opened for reading /proc/15/cmdline ps File opened for reading /proc/169/cmdline ps File opened for reading /proc/721/status ps File opened for reading /proc/1/status ps File opened for reading /proc/9/status ps File opened for reading /proc/19/cmdline ps File opened for reading /proc/97/cmdline ps File opened for reading /proc/294/status ps File opened for reading /proc/690/stat ps File opened for reading /proc/707/stat ps File opened for reading /proc/filesystems sudo File opened for reading /proc/14/stat ps File opened for reading /proc/29/stat ps File opened for reading /proc/43/cmdline ps File opened for reading /proc/107/stat ps File opened for reading /proc/3/stat ps File opened for reading /proc/307/cmdline ps File opened for reading /proc/321/cmdline ps File opened for reading /proc/75/cmdline ps File opened for reading /proc/307/stat ps
Processes
-
/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"1⤵PID:709
-
/usr/bin/dirnamedirname "/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"2⤵PID:710
-
-
/usr/bin/basenamebasename "\"\""2⤵PID:711
-
-
/usr/bin/awkawk -F . "{print \$1 \".\" \$2}"2⤵
- Reads runtime system information
PID:714
-
-
/usr/bin/awkawk "{print \$1 \",\" \$2}"2⤵PID:721
-
-
/bin/psps -axo "pid,uid,args"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:719
-
-
/bin/grepgrep -i "[l]oginwindow.app"2⤵PID:720
-
-
/bin/shsh2⤵PID:723
-
/usr/bin/sudo/usr/bin/sudo -u " File: /dev/console ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 253568 Free: 253568 Available: 253568 Inodes: Total: 183553 Free: 183286" /bin/launchctl load -w3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:725
-
-
-
/usr/bin/statstat -f "%Su" /dev/console2⤵PID:724
-