← Reports

InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author
Moise Medici
Updated
10 Sept 2026 · Completed
Difficulty
Easy
Platform
MacOS
Family
Essential macOS Stealer
Languages
BashAppleScript
MITRE
T1059.002 (Command and Scripting Interpreter: AppleScript) T1059.004 (Command and Scripting Interpreter: Unix Shell) T1569.001 (System Services: Launchctl) T1543.001 (Create or Modify System Process: Launch Agent) T1548.006 (Abuse Elevation Control Mechanism: TCC Manipulation) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1027.016 (Obfuscated Files or Information: Junk Code Insertion) T1140 (Deobfuscate/Decode Files or Information) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1056.002 (Input Capture: GUI Input Capture) T1539 (Steal Web Session Cookie) T1555.001 (Credentials from Password Stores: Keychain) T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) T1555.005 (Credentials from Password Stores: Password Managers) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1082 (System Information Discovery) T1083 (File and Directory Discovery) T1217 (Browser Information Discovery) T1005 (Data from Local System) T1074.001 (Data Staged: Local Data Staging) T1119 (Automated Collection) T1560.001 (Archive Collected Data: Archive via Utility) T1008 (Fallback Channels) T1071.001 (Application Layer Protocol: Web Protocols) T1102.001 (Web Service: Dead Drop Resolver) T1105 (Ingress Tool Transfer) T1041 (Exfiltration Over C2 Channel)

File Info

File Name
script.applescript
SHA-256
5f59a4cedf19158da7af5f93a4851b044f9bd247f2b8b31756e197721e64e9e7
Size
18 KB
Download sample (.zip)

This was downloaded a few months ago after randomly visiting https://novarift.digital/script.sh.

The zip file linked above contains:

  • id_to_char.py
  • script.sh
  • stage2.applescript
  • stage3.applescript
  • stage3_manual_clean.applescript
  • stage3_py_clean.applescript
  • stage4.applescript
  • stage4_clean.applescript
  • stage5_ledger.sh
  • stage5_lmodule.applescript
  • stage5_lmodule_clean.applescript
  • stage5_smodule.applescript
  • stage5_smodule_clean.applescript

id_to_char.py is a custom script written to perform a first, rough level of deobfuscation. It has been applied to all the different stages.

script.sh is the sample as downloaded from the website, while the other files are samples dropped by the different stages.

There are three different stage5 variants because multiple droppers can be received; these are the ones I have been able to download.