InfoStealer · Dropper
Essential macOS Stealer - script.sh
- Author
- Moise Medici
- Updated
- 10 Sept 2026 · Completed
- Difficulty
- Easy
- Platform
- Family
- Languages
- MITRE
MITRE ATT&CK
Execution
Command and Scripting Interpreter: AppleScript
script.sh runs the decoded stage 2 through osascript -e, and every later stage (stage 3, bmodule, smodule, lmodule) is AppleScript fetched with curl and piped straight into osascript.Command and Scripting Interpreter: Unix Shell
All stages shell out through
do shell script, the openshell and ledger tasks pipe the C2 response into sh, and downloaded modules are launched in the background with nohup sh -c.System Services: Launchctl
Stage 2 runs
launchctl unload and then launchctl load on ~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist, so launchd starts the Base64-encoded stage 3 payload right away.Persistence
Create or Modify System Process: Launch Agent
Stage 2 writes
~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist with RunAtLoad and KeepAlive set to true, so the stage 3 AppleScript runs at every login and restarts whenever it exits.Privilege Escalation
Abuse Elevation Control Mechanism: TCC Manipulation
The
smodule runs a helper AppleScript inside tell application "Finder" so that Finder’s own access duplicates the TCC-protected Cookies.binarycookies from the Safari container into ~/tempFolderC.Stealth
Obfuscated Files or Information: Command Obfuscation
Stage 1 hides stage 2 as a Base64 string passed to
osascript -e, and stage 3 builds its RPC hosts, JSON-RPC payload and curl commands from character id and ASCII character concatenations.Obfuscated Files or Information: Junk Code Insertion
Stage 3 opens with dead assignments that are never used, such as
set _wGDgMr5 to (38 + 689) * 3 and properties holding random strings like POt5pjxcyKcAN0kZyKR.Deobfuscate/Decode Files or Information
base64 -d decodes the stage 2 and stage 3 AppleScript just before it is piped to osascript, and xxd -r -p turns the hex string returned by the contract into the C2 domain.Hide Artifacts: Hidden Files and Directories
The captured login password is written to
~/.passphrase and the campaign token to ~/.txid, dot-prefixed files that Finder and ls hide by default.Credential Access
Input Capture: GUI Input Capture
A fake
display dialog titled System Preferences asks for the password with hidden answer, checks each attempt with dscl . authonly and keeps asking until it is correct.Steal Web Session Cookie
The
smodule copies Chromium Cookies and Network/Cookies, Firefox cookies.sqlite and cookies.sqlite-wal, and Safari Cookies.binarycookies into the staging directory for upload.Credentials from Password Stores: Keychain
On macOS 26.4 and later it reads
Chrome Safe Storage and four other browser keys with security find-generic-password -w -s; on older versions it copies ~/Library/Keychains/login.keychain-db.Credentials from Password Stores: Credentials from Web Browsers
It copies
Login Data and Web Data from every profile of eleven Chromium browsers, and logins.json, logins-backup.json, signons.sqlite, key4.db and cert9.db from each Firefox profile.Credentials from Password Stores: Password Managers
It copies the
Local Extension Settings and IndexedDB data of password manager extensions such as 1Password, Bitwarden, LastPass, NordPass and iCloud Passwords from every Chromium profile.Discovery
System Network Configuration Discovery
The
smodule looks up the victim’s public IP address with curl -fsSL http://api.ipify.org/ and records it in the UserInformation file.System Owner/User Discovery
getLogonName tries whoami, id -un, echo $USER and logname, and the smodule reads system attribute "USER"; the username is sent to the C2 and saved to the staging directory.System Information Discovery
It reads
IOPlatformUUID through ioreg or system_profiler SPHardwareDataType as the bot ID, branches on system version of (system info), and saves system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType output.File and Directory Discovery
It walks the
entire contents of the Desktop and Documents folders, enumerates browser profile folders with list folder, and probes 22 wallet paths with test -d before copying them.Browser Information Discovery
It copies the
History database from every Chromium profile and places.sqlite and formhistory.sqlite from every Firefox profile, exposing the victim’s browsing and form history.Collection
Data from Local System
It copies 22 desktop wallet folders such as
Exodus/ and ~/.electrum/wallets/, wallet extension data, Telegram tdata, and the text of every note read through tell application "Notes".Data Staged: Local Data Staging
Stolen data is gathered under
/tmp/1e23d6097631b47c39f3289489aa94001788881737/ in Browsers/, Wallets/, FileGrabber/ and files like Password and UserInformation, with Safari cookies passing through ~/tempFolderC first.Automated Collection
The file grabber automatically copies every Desktop and Documents file smaller than 250,000 bytes until 5,000,000 bytes in total, renaming each by index into randomized
FileGrabber/ subfolders.Archive Collected Data: Archive via Utility
The staging directory is compressed with
ditto -c -k --sequesterRsrc into /tmp/1e23d6097631b47c39f3289489aa94001788881737.zip before it is uploaded.Command and Control
Fallback Channels
The archive normally goes to
https://d9mjs.sbs/upload.php, but the upload switches to http://62.60.226.50/upload.php when that request fails or the zip exceeds 90 MB.Application Layer Protocol: Web Protocols
Bots POST
uuid, username and txid with connect or task to https://d9mjs.sbs/ via curl and act on plain-text replies such as newconnect, runloader and openshell.Web Service: Dead Drop Resolver
The C2 domain is stored in Polygon contract
0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0; an eth_call with selector 0x2686ecea to public RPC hosts such as polygon.drpc.org returns d9mjs.sbs.Ingress Tool Transfer
Stages 3 and 4 download the next AppleScript (
bmodule, smodule, lmodule) and the ledger shell script from https://d9mjs.sbs with curl -X POST and pipe them to osascript or sh.