← Reports

InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author
Moise Medici
Updated
10 Sept 2026 · Completed
Difficulty
Easy
Platform
MacOS
Capabilities
Command and Control C2 CommunicationCommand Execution via Powershell Cmd BashCredential TheftData-ExfiltrationDropping Secondary Payloads
Tags
bashAppleScriptEssential macOS Stealer

Indicators Of Compromise

Network

  • novarift.digital
  • d9mjs.sbs C2 domain, resolved via a Polygon smart-contract call
  • 62.60.226.50 fallback C2 / exfiltration IP

Persistence

  • com.guqtsajmydvdqbwg LaunchAgent label
  • ~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist

Files

  • /tmp/1e23d6097631b47c39f3289489aa94001788881737/ staging dir, smodule
  • /tmp/94a8cb76e4d36ee8c6f0b8a5676c57551788950610/ staging dir, lmodule
  • ~/.passphrase
  • ~/.txid

Hash · SHA-256

  • 5f59a4cedf19158da7af5f93a4851b044f9bd247f2b8b31756e197721e64e9e7

Campaign

  • 7dc957c3cfcbf7bb79ff3b8f0f8288a9 txid / campaign token
  • 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 Polygon contract queried to resolve the C2 domain
  • NITRO build label