← Reports

InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author
Moise Medici
Updated
10 Sept 2026 · Completed
Difficulty
Easy
Platform
MacOS
Family
Essential macOS Stealer
Languages
BashAppleScript
MITRE
T1059.002 (Command and Scripting Interpreter: AppleScript) T1059.004 (Command and Scripting Interpreter: Unix Shell) T1569.001 (System Services: Launchctl) T1543.001 (Create or Modify System Process: Launch Agent) T1548.006 (Abuse Elevation Control Mechanism: TCC Manipulation) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1027.016 (Obfuscated Files or Information: Junk Code Insertion) T1140 (Deobfuscate/Decode Files or Information) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1056.002 (Input Capture: GUI Input Capture) T1539 (Steal Web Session Cookie) T1555.001 (Credentials from Password Stores: Keychain) T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) T1555.005 (Credentials from Password Stores: Password Managers) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1082 (System Information Discovery) T1083 (File and Directory Discovery) T1217 (Browser Information Discovery) T1005 (Data from Local System) T1074.001 (Data Staged: Local Data Staging) T1119 (Automated Collection) T1560.001 (Archive Collected Data: Archive via Utility) T1008 (Fallback Channels) T1071.001 (Application Layer Protocol: Web Protocols) T1102.001 (Web Service: Dead Drop Resolver) T1105 (Ingress Tool Transfer) T1041 (Exfiltration Over C2 Channel)

Stage1 Code Analysis

The file is an .applescript, so it can be read easily. Its contents are:

script.sh
osascript -e "$(echo "<long string>==" | base64 -d)"

Two things immediately stand out: osascript and base64 -d. The latter is a clear clue that the long string is Base64-decoded (-d), while the former tells us that the sample targets macOS devices. 1

Execute AppleScripts and other OSA language scripts. Executes the given script file, or standard input if none is given. Scripts can be plain text or compiled scripts. osascript was designed for use with AppleScript, but will work with any Open Scripting Architecture (OSA) language.

The string can be decoded as follows:

echo "<long string>==" | base64 -d > stage2.applescript