InfoStealer · Dropper
Essential macOS Stealer - script.sh
- Author
- Moise Medici
- Updated
- 10 Sept 2026 · Completed
- Difficulty
- Easy
- Platform
- Capabilities
- Tags
File Info
File Name
script.applescript
SHA-256
5f59a4cedf19158da7af5f93a4851b044f9bd247f2b8b31756e197721e64e9e7
Size
18 KB
This was downloaded a few months ago after randomly visiting https://novarift.digital/script.sh.
The zip file linked above contains:
- id_to_char.py
- script.sh
- stage2.applescript
- stage3.applescript
- stage3_manual_clean.applescript
- stage3_py_clean.applescript
- stage4.applescript
- stage4_clean.applescript
- stage5_ledger.sh
- stage5_lmodule.applescript
- stage5_lmodule_clean.applescript
- stage5_smodule.applescript
- stage5_smodule_clean.applescript
id_to_char.py is a custom script written to perform a first, rough level of deobfuscation. It has been applied to all the different stages.
script.sh is the sample as downloaded from the website, while the other files are samples dropped by the different stages.
There are three different stage5 variants because multiple droppers can be received; these are the ones I have been able to download.