Overview
overview
8Static
static
3SplashtopSOS.dmg
macos-10.15-amd64
7Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ...Helper
macos-10.15-amd64
1Splashtop ...Helper
macos-10.15-amd64
1Splashtop ...sTools
macos-10.15-amd64
1Splashtop ...op SOS
macos-10.15-amd64
1Splashtop ... Agent
macos-10.15-amd64
1Splashtop ...s.html
windows10-2004-x64
3Splashtop ...s.html
windows11-ltsc_2024-x64
4Splashtop ...Helper
macos-10.15-amd64
4Splashtop ...AL.htm
windows10-2004-x64
3Splashtop ...AL.htm
windows11-ltsc_2024-x64
4Splashtop ...Helper
macos-10.15-amd64
4Splashtop ...ht.ps1
windows10-2004-x64
3Splashtop ...ht.ps1
windows11-ltsc_2024-x64
8Splashtop ...ent.sh
ubuntu-18.04-amd64
Splashtop ...ent.sh
debian-9-armhf
Splashtop ...ent.sh
debian-9-mips
Splashtop ...ent.sh
debian-9-mipsel
Splashtop ...nts.sh
ubuntu-18.04-amd64
6Splashtop ...nts.sh
debian-9-armhf
6Splashtop ...nts.sh
debian-9-mips
6Splashtop ...nts.sh
debian-9-mipsel
6Splashtop ...ons.sh
ubuntu-18.04-amd64
3Splashtop ...ons.sh
debian-9-armhf
3Splashtop ...ons.sh
debian-9-mips
3Splashtop ...ons.sh
debian-9-mipsel
3Splashtop ...ent.sh
ubuntu-18.04-amd64
6Splashtop ...ent.sh
debian-9-armhf
6Analysis
- max time kernel
2s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
arch:mipsimage:debian9-mipsbe-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipssystem - submitted
23/06/2026, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
SplashtopSOS.dmg
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral2
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libcrypto.3.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral3
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libssl.3.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral4
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libwebsockets.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral5
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libyuv.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral6
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRFileHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRSOSHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral8
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRUtilitiesTools
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral9
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral10
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral11
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/AttendendInstallHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral14
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/SRWatchNotesHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral17
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.ps1
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral29
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral30
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral31
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral32
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
General
- Target Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
- Size 3KB
- Sample260623-alaeeshs5j
- SHA256 3b639f6434fa462861ffb85902f5f829ebce70bf010009b1e5ec3a669cb95e71
- MD5 a22ed78b094c48a69c8d521e4bad25a5
- SHA1 84564e39c18bfa1018ad6cac38be2cb59b709f23
- SHA512 e0d2c95f97001f7e201d8a991b4b35272f15face65b6876fe05db69cdeceebc62b2a3c7c75785e6536ceb7ff4cbe9f350f5939cc3c44a10164b76be7087f67d6
- TLSH T15D61DDE87254E1781146943D404B585AB3873A87D564343CF22FD95E2F58AFC32A92EF
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 750 sudo - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/70/stat ps File opened for reading /proc/149/stat ps File opened for reading /proc/6/stat ps File opened for reading /proc/13/cmdline ps File opened for reading /proc/20/stat ps File opened for reading /proc/filesystems sudo File opened for reading /proc/1/status ps File opened for reading /proc/73/cmdline ps File opened for reading /proc/376/status ps File opened for reading /proc/731/cmdline ps File opened for reading /proc/743/status ps File opened for reading /proc/69/stat ps File opened for reading /proc/111/status ps File opened for reading /proc/7/stat ps File opened for reading /proc/7/status ps File opened for reading /proc/36/status ps File opened for reading /proc/76/stat ps File opened for reading /proc/79/status ps File opened for reading /proc/149/cmdline ps File opened for reading /proc/169/status ps File opened for reading /proc/669/status ps File opened for reading /proc/70/cmdline ps File opened for reading /proc/745/stat ps File opened for reading /proc/self/stat ps File opened for reading /proc/68/cmdline ps File opened for reading /proc/71/status ps File opened for reading /proc/376/stat ps File opened for reading /proc/9/stat ps File opened for reading /proc/14/status ps File opened for reading /proc/731/status ps File opened for reading /proc/733/stat ps File opened for reading /proc/79/cmdline ps File opened for reading /proc/149/status ps File opened for reading /proc/411/cmdline ps File opened for reading /proc/663/stat ps File opened for reading /proc/731/stat ps File opened for reading /proc/sys/kernel/osrelease ps File opened for reading /proc/uptime ps File opened for reading /proc/10/stat ps File opened for reading /proc/72/status ps File opened for reading /proc/673/cmdline ps File opened for reading /proc/746/status ps File opened for reading /proc/10/status ps File opened for reading /proc/23/cmdline ps File opened for reading /proc/118/status ps File opened for reading /proc/18/stat ps File opened for reading /proc/72/stat ps File opened for reading /proc/358/cmdline ps File opened for reading /proc/697/stat ps File opened for reading /proc/745/cmdline ps File opened for reading /proc/8/status ps File opened for reading /proc/22/status ps File opened for reading /proc/674/cmdline ps File opened for reading /proc/2/status ps File opened for reading /proc/71/stat ps File opened for reading /proc/666/stat ps File opened for reading /proc/669/cmdline ps File opened for reading /proc/697/status ps File opened for reading /proc/746/cmdline ps File opened for reading /proc/2/cmdline ps File opened for reading /proc/16/status ps File opened for reading /proc/76/status ps File opened for reading /proc/243/status ps File opened for reading /proc/5/stat ps
Processes
-
/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"1⤵PID:733
-
/usr/bin/dirnamedirname "/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"2⤵PID:735
-
-
/usr/bin/basenamebasename "\"\""2⤵PID:739
-
-
/usr/bin/awkawk -F . "{print \$1 \".\" \$2}"2⤵PID:742
-
-
/bin/grepgrep -i "[l]oginwindow.app"2⤵PID:745
-
-
/usr/bin/awkawk "{print \$1 \",\" \$2}"2⤵PID:746
-
-
/bin/psps -axo "pid,uid,args"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:744
-
-
/bin/shsh2⤵PID:748
-
/usr/bin/sudo/usr/bin/sudo -u " File: /dev/console ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 28788 Free: 28788 Available: 28788 Inodes: Total: 28788 Free: 28479" /bin/launchctl load -w3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:750
-
-
-
/usr/bin/statstat -f "%Su" /dev/console2⤵PID:749
-