splashtop.logs

$ target-query <path/to/target> -f splashtop.logs

Details

Module	dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin
Output	records

Module documentation

Splashtop plugin.

Function documentation

Parse Splashtop log files.

Splashtop is a remote desktop application that can be used to get (persistent) access to a machine. It might be used in combination with Atera Management Agent.

References:

• https://www.synacktiv.com/en/publications/legitimate-rats-a-comprehensive-forensic-analysis-of-the-usual-suspects#atera-and-splashtop