f2914ed62297e8682fff44768166e60312fc2fa61a62eb0199e6991d067991d6

Analysis

max time kernel
1s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
23/06/2026, 00:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
Size 913B
Sample260623-alaeeshs5j
SHA256 f2914ed62297e8682fff44768166e60312fc2fa61a62eb0199e6991d067991d6
MD5 09814f14ef4082b4a05652dd428b506e
SHA1 51b6212ea28f839d0ac033856a88f74956b46cf8
SHA512 aa526e13e2cf2193384916fb303c781a1ff7f34c898427a950222b8eac2b913150db45a22f3ef6b4c269c49f89d121764b24594c4563def893a8cb7779d5c338
TLSH
T13F1100B205403C7067C3155E9A0E222320F23707E4CB6C817F7F6B101F7C54857464B2
MD5 SHA1 SHA512 TLSH

Score

6^/10

defense_evasion discovery privilege_escalation

Malware Config

Signatures

Abuse Elevation Control Mechanism: Sudo and Sudo Caching 1 TTPs 2 IoCs

Abuse sudo or cached sudo credentials to execute code.

privilege_escalation defense_evasion

Sudo and Sudo Caching

T1548.003

pid	Process
726	sudo
723	sudo

Reads runtime system information 9 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	stat
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/self/stat	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/filesystems	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/fd	sudo
File opened for reading	/proc/sys/kernel/ngroups_max	sudo
File opened for reading	/proc/self/stat	sudo

/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
"/tmp/Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh"
1⤵
PID:717
- /usr/bin/stat
  stat -f "%Su" /dev/console
  2⤵
  - Reads runtime system information
  PID:718
- /usr/bin/sudo
  sudo rm -rf /Library/LaunchAgents/com.splashtop.sos.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:723
- - /bin/rm
    rm -rf /Library/LaunchAgents/com.splashtop.sos.plist
    3⤵
    PID:725
- /usr/bin/sudo
  sudo rm -rf /Library/LaunchDaemons/com.splashtop.sos-agent.plist
  2⤵
  - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
  - Reads runtime system information
  PID:726
- - /bin/rm
    rm -rf /Library/LaunchDaemons/com.splashtop.sos-agent.plist
    3⤵
    PID:727

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Sudo and Sudo Caching

T1548.003

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads