← Reports

InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author
Moise Medici
Updated
10 Sept 2026 · Completed
Difficulty
Easy
Platform
MacOS
Capabilities
Command and Control C2 CommunicationCommand Execution via Powershell Cmd BashCredential TheftData-ExfiltrationDropping Secondary Payloads
Tags
bashAppleScriptEssential macOS Stealer

File Info

File Name
script.applescript
SHA-256
5f59a4cedf19158da7af5f93a4851b044f9bd247f2b8b31756e197721e64e9e7
Size
18 KB
Download sample (.zip)

This was downloaded a few months ago after randomly visiting https://novarift.digital/script.sh.

The zip file linked above contains:

  • id_to_char.py
  • script.sh
  • stage2.applescript
  • stage3.applescript
  • stage3_manual_clean.applescript
  • stage3_py_clean.applescript
  • stage4.applescript
  • stage4_clean.applescript
  • stage5_ledger.sh
  • stage5_lmodule.applescript
  • stage5_lmodule_clean.applescript
  • stage5_smodule.applescript
  • stage5_smodule_clean.applescript

id_to_char.py is a custom script written to perform a first, rough level of deobfuscation. It has been applied to all the different stages.

script.sh is the sample as downloaded from the website, while the other files are samples dropped by the different stages.

There are three different stage5 variants because multiple droppers can be received; these are the ones I have been able to download.