Overview
overview
8Static
static
3SplashtopSOS.dmg
macos-10.15-amd64
7Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ....dylib
macos-10.15-amd64
1Splashtop ...Helper
macos-10.15-amd64
1Splashtop ...Helper
macos-10.15-amd64
1Splashtop ...sTools
macos-10.15-amd64
1Splashtop ...op SOS
macos-10.15-amd64
1Splashtop ... Agent
macos-10.15-amd64
1Splashtop ...s.html
windows10-2004-x64
3Splashtop ...s.html
windows11-ltsc_2024-x64
4Splashtop ...Helper
macos-10.15-amd64
4Splashtop ...AL.htm
windows10-2004-x64
3Splashtop ...AL.htm
windows11-ltsc_2024-x64
4Splashtop ...Helper
macos-10.15-amd64
4Splashtop ...ht.ps1
windows10-2004-x64
3Splashtop ...ht.ps1
windows11-ltsc_2024-x64
8Splashtop ...ent.sh
ubuntu-18.04-amd64
Splashtop ...ent.sh
debian-9-armhf
Splashtop ...ent.sh
debian-9-mips
Splashtop ...ent.sh
debian-9-mipsel
Splashtop ...nts.sh
ubuntu-18.04-amd64
6Splashtop ...nts.sh
debian-9-armhf
6Splashtop ...nts.sh
debian-9-mips
6Splashtop ...nts.sh
debian-9-mipsel
6Splashtop ...ons.sh
ubuntu-18.04-amd64
3Splashtop ...ons.sh
debian-9-armhf
3Splashtop ...ons.sh
debian-9-mips
3Splashtop ...ons.sh
debian-9-mipsel
3Splashtop ...ent.sh
ubuntu-18.04-amd64
6Splashtop ...ent.sh
debian-9-armhf
6Analysis
- max time kernel
3s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
arch:mipselimage:debian9-mipsel-20260513-enkernel:4.9.0-13-4kc-maltalocale:en-usos:debian-9-mipselsystem - submitted
23/06/2026, 00:17
Static task
static1
Behavioral task
behavioral1
Sample
SplashtopSOS.dmg
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral2
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libcrypto.3.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral3
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libssl.3.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral4
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libwebsockets.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral5
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libyuv.dylib
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral6
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRFileHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral7
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRSOSHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral8
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRUtilitiesTools
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral9
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral10
Sample
Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral11
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/AttendendInstallHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral14
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/SRWatchNotesHelper
Resource
macos-20250619-en
macos-10.15-amd64
Behavioral task
behavioral17
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.ps1
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.ps1
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral20
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral21
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral22
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral23
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral24
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral25
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral26
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral27
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral28
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
Behavioral task
behavioral29
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
Behavioral task
behavioral30
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
Behavioral task
behavioral31
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral32
Sample
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
General
- Target Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
- Size 3KB
- Sample260623-alaeeshs5j
- SHA256 3b639f6434fa462861ffb85902f5f829ebce70bf010009b1e5ec3a669cb95e71
- MD5 a22ed78b094c48a69c8d521e4bad25a5
- SHA1 84564e39c18bfa1018ad6cac38be2cb59b709f23
- SHA512 e0d2c95f97001f7e201d8a991b4b35272f15face65b6876fe05db69cdeceebc62b2a3c7c75785e6536ceb7ff4cbe9f350f5939cc3c44a10164b76be7087f67d6
- TLSH T15D61DDE87254E1781146943D404B585AB3873A87D564343CF22FD95E2F58AFC32A92EF
- MD5 SHA1 SHA512 TLSH
Malware Config
Signatures
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 1 IoCs
Abuse sudo or cached sudo credentials to execute code.
pid Process 750 sudo - Enumerates running processes
Discovers information about currently running processes on the system
- Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ps -
description ioc Process File opened for reading /proc/8/cmdline ps File opened for reading /proc/10/status ps File opened for reading /proc/333/status ps File opened for reading /proc/124/status ps File opened for reading /proc/682/stat ps File opened for reading /proc/self/stat sudo File opened for reading /proc/7/status ps File opened for reading /proc/68/cmdline ps File opened for reading /proc/78/cmdline ps File opened for reading /proc/154/cmdline ps File opened for reading /proc/uptime ps File opened for reading /proc/3/cmdline ps File opened for reading /proc/17/status ps File opened for reading /proc/21/stat ps File opened for reading /proc/36/cmdline ps File opened for reading /proc/80/status ps File opened for reading /proc/159/cmdline ps File opened for reading /proc/360/cmdline ps File opened for reading /proc/self/maps awk File opened for reading /proc/22/cmdline ps File opened for reading /proc/13/stat ps File opened for reading /proc/74/cmdline ps File opened for reading /proc/76/status ps File opened for reading /proc/703/cmdline ps File opened for reading /proc/filesystems ps File opened for reading /proc/77/stat ps File opened for reading /proc/78/stat ps File opened for reading /proc/124/cmdline ps File opened for reading /proc/681/stat ps File opened for reading /proc/5/status ps File opened for reading /proc/333/cmdline ps File opened for reading /proc/12/status ps File opened for reading /proc/24/stat ps File opened for reading /proc/124/stat ps File opened for reading /proc/125/cmdline ps File opened for reading /proc/20/stat ps File opened for reading /proc/159/status ps File opened for reading /proc/709/stat ps File opened for reading /proc/381/status ps File opened for reading /proc/727/status ps File opened for reading /proc/16/cmdline ps File opened for reading /proc/12/stat ps File opened for reading /proc/36/status ps File opened for reading /proc/249/status ps File opened for reading /proc/2/stat ps File opened for reading /proc/15/cmdline ps File opened for reading /proc/18/status ps File opened for reading /proc/19/cmdline ps File opened for reading /proc/23/status ps File opened for reading /proc/125/status ps File opened for reading /proc/702/status ps File opened for reading /proc/734/stat ps File opened for reading /proc/744/status ps File opened for reading /proc/8/stat ps File opened for reading /proc/672/stat ps File opened for reading /proc/743/stat ps File opened for reading /proc/731/stat ps File opened for reading /proc/37/stat ps File opened for reading /proc/69/status ps File opened for reading /proc/72/cmdline ps File opened for reading /proc/745/status ps File opened for reading /proc/9/stat ps File opened for reading /proc/19/status ps File opened for reading /proc/68/stat ps
Processes
-
/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"1⤵PID:734
-
/usr/bin/dirnamedirname "/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh"2⤵PID:735
-
-
/usr/bin/basenamebasename "\"\""2⤵PID:737
-
-
/usr/bin/awkawk -F . "{print \$1 \".\" \$2}"2⤵
- Reads runtime system information
PID:742
-
-
/usr/bin/awkawk "{print \$1 \",\" \$2}"2⤵PID:746
-
-
/bin/grepgrep -i "[l]oginwindow.app"2⤵PID:745
-
-
/bin/psps -axo "pid,uid,args"2⤵
- Reads CPU attributes
- Reads runtime system information
PID:744
-
-
/usr/bin/statstat -f "%Su" /dev/console2⤵PID:749
-
-
/bin/shsh2⤵PID:748
-
/usr/bin/sudo/usr/bin/sudo -u " File: /dev/console ID: 0 Namelen: 255 Type: tmpfs Block size: 4096 Fundamental block size: 4096 Blocks: Total: 28825 Free: 28825 Available: 28825 Inodes: Total: 28825 Free: 28516" /bin/launchctl load -w3⤵
- Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- Reads runtime system information
PID:750
-
-