Overview

overview

7

Static

static

3

SplashtopSOS.dmg

macos-10.15-amd64

7

Splashtop ....dylib

macos-10.15-amd64

1

Splashtop ....dylib

macos-10.15-amd64

1

Splashtop ....dylib

macos-10.15-amd64

1

Splashtop ....dylib

macos-10.15-amd64

1

Splashtop ...Helper

macos-10.15-amd64

1

Splashtop ...Helper

macos-10.15-amd64

1

Splashtop ...sTools

macos-10.15-amd64

1

Splashtop ...op SOS

macos-10.15-amd64

1

Splashtop ... Agent

macos-10.15-amd64

1

Splashtop ...s.html

windows10-2004-x64

3

Splashtop ...s.html

windows11-ltsc_2024-x64

3

Splashtop ...Helper

macos-10.15-amd64

4

Splashtop ...AL.htm

windows10-2004-x64

3

Splashtop ...AL.htm

windows11-ltsc_2024-x64

3

Splashtop ...Helper

macos-10.15-amd64

4

Splashtop ...ht.ps1

windows10-2004-x64

3

Splashtop ...ht.ps1

windows11-ltsc_2024-x64

3

Splashtop ...ent.sh

ubuntu-18.04-amd64

Splashtop ...ent.sh

debian-9-armhf

Splashtop ...ent.sh

debian-9-mips

Splashtop ...ent.sh

debian-9-mipsel

Splashtop ...nts.sh

ubuntu-18.04-amd64

6

Splashtop ...nts.sh

debian-9-armhf

6

Splashtop ...nts.sh

debian-9-mips

Splashtop ...nts.sh

debian-9-mipsel

Splashtop ...ons.sh

ubuntu-18.04-amd64

3

Splashtop ...ons.sh

debian-9-armhf

3

Splashtop ...ons.sh

debian-9-mips

Splashtop ...ons.sh

debian-9-mipsel

Splashtop ...ent.sh

ubuntu-18.04-amd64

6

Splashtop ...ent.sh

debian-9-armhf

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    SplashtopSOS.dmg
  • Size 37.1MB
  • Sample260804-g12ksaxyas
  • SHA256 27e41d0ed5b344725d8578b6159aa82545a7f427ca4d9490cf36117debb0772e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionlinuxmacosprivilege_escalation

Malware Config

Targets

    • Target
      SplashtopSOS.dmg
    • Size 37.1MB
    • SHA256 27e41d0ed5b344725d8578b6159aa82545a7f427ca4d9490cf36117debb0772e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscovery

    • System Checks

      Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

      defense_evasion
    behavioral1
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libcrypto.3.dylib
    • Size 9.2MB
    • SHA256 c3d3f4788de2f15b78cc2864a0c9f3612f3c67f4a0578ecb21e9dc8a6b8b8943
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral2
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libssl.3.dylib
    • Size 2.0MB
    • SHA256 7dd66b02b05e34aebf442f97c292773ca8e5dad516ed10d3e4f47d8412139e8f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libwebsockets.dylib
    • Size 355KB
    • SHA256 16b58c56fab9cbdc80cd9e2d6da619658960c9a02f0d9b47d89a64a6245f8282
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral4
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Frameworks/libyuv.dylib
    • Size 951KB
    • SHA256 8cd1de742bf531f8594ab6beafcec4d350e2fd8cd0d9e415327785b1961f82ce
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral5
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRFileHelper
    • Size 351KB
    • SHA256 75c4276bbcc5edbb76213f4e358f82adfe165c852caa55551ad62c41d071ae71
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral6
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRSOSHelper
    • Size 202KB
    • SHA256 f775d4df70460453f8512cb20677c15c78478aba210d4f8cbc62c153f1a1cc48
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral7
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/SRUtilitiesTools
    • Size 138KB
    • SHA256 b3297b27078ab6ba030164df483f08b0b450f3ecb67af0ff6fced8338bff9715
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral8
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS
    • Size 7.2MB
    • SHA256 f94e96357c1cfa33633c0a0e66a9acc354f213e91322ceb53557f422761bed83
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral9
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/MacOS/Splashtop SOS Agent
    • Size 4.4MB
    • SHA256 85d259df0ea8121a46b1740c4ae695d65f90bb063e2c1d1648b9d22f5c2fe0ad
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral10
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/Acknowledgements.html
    • Size 122KB
    • SHA256 2cdfd760947e739a67dea9fd688eb384d4ebf1f1930fea5aabb0f6cff1a66198
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral11behavioral12
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/AttendendInstallHelper
    • Size 202KB
    • SHA256 f8fe2b2d737cb62fc9ca9df55efe9c691a27d992122b5efc4b8a420e7f41658c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    defense_evasion
    behavioral13
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/EVAL.htm
    • Size 79KB
    • SHA256 3fcdf340a6e24084938317e4fd57fc1d7c321f711f6ddba7876f6987e6f7a54b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral14behavioral15
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/SRWatchNotesHelper
    • Size 133KB
    • SHA256 93f4ef89300f5dfabaf0afdc165c2b11c7d4b8e377dc4d49a1409ab5dd7610bb
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    4/10
    defense_evasion
    behavioral16
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/icon_voice_sound_light.tiff
    • Size 8KB
    • SHA256 05ba7d6945762765e6f8ae39661b9281f292784b8c7a78f0525464e41311ad61
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral17behavioral18
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/install_sos_agent.sh
    • Size 4KB
    • SHA256 3285c22e7bc7460709dbef54d7e0e0156c834421b8d2e4527fa7c8e989783e92
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    6/10
    defense_evasiondiscoveryprivilege_escalation
    behavioral19behavioral20behavioral21behavioral22
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/load_agents.sh
    • Size 3KB
    • SHA256 3b639f6434fa462861ffb85902f5f829ebce70bf010009b1e5ec3a669cb95e71
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    defense_evasiondiscoveryprivilege_escalation

    • Abuse Elevation Control Mechanism: Sudo and Sudo Caching

      Abuse sudo or cached sudo credentials to execute code.

      privilege_escalationdefense_evasion

    • Enumerates running processes

      Discovers information about currently running processes on the system

    behavioral23behavioral24behavioral25behavioral26
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/scripts/reset_privacy_permissions.sh
    • Size 4KB
    • SHA256 532c974d60a3bed348ea60b81d939c5700667a6592150e42018b55737f9b6438
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral27behavioral28behavioral29behavioral30
    • Target
      Splashtop SOS/Splashtop SOS.app/Contents/Resources/uninstall_sos_agent.sh
    • Size 913B
    • SHA256 f2914ed62297e8682fff44768166e60312fc2fa61a62eb0199e6991d067991d6
    • MD5 SHA1 SHA512 TLSH
    Score
    6/10
    defense_evasiondiscoveryprivilege_escalation
    behavioral31behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Sudo and Sudo Caching

1
T1548.003

Hide Artifacts

1
T1564

Resource Forking

1
T1564.009

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Credential Access

Discovery

Browser Information Discovery

1
T1217

Query Registry

2
T1012

Software Discovery

1
T1518

Security Software Discovery

1
T1518.001

System Information Discovery

4
T1082

System Network Configuration Discovery

1
T1016

System Time Discovery

1
T1124

Virtualization/Sandbox Evasion

1
T1497

System Checks

1
T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscovery
Score
7/10

behavioral2

Score
1/10

behavioral3

Score
1/10

behavioral4

Score
1/10

behavioral5

Score
1/10

behavioral6

Score
1/10

behavioral7

Score
1/10

behavioral8

Score
1/10

behavioral9

Score
1/10

behavioral10

Score
1/10

behavioral11

discovery
Score
3/10

behavioral12

discovery
Score
3/10

behavioral13

defense_evasion
Score
4/10

behavioral14

discovery
Score
3/10

behavioral15

discovery
Score
3/10

behavioral16

defense_evasion
Score
4/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral20

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral21

Score
1/10

behavioral22

Score
1/10

behavioral23

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral24

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral25

Score
1/10

behavioral26

Score
1/10

behavioral27

discovery
Score
3/10

behavioral28

discovery
Score
3/10

behavioral29

Score
1/10

behavioral30

Score
1/10

behavioral31

defense_evasiondiscoveryprivilege_escalation
Score
6/10

behavioral32

defense_evasiondiscoveryprivilege_escalation
Score
6/10