In Part 1: Suspicious Download — The Hidden URL, we traced the download command, decoded its hidden URL, and explained why piping a remote response straight into Zsh is risky.

In this article, we’ll inspect the downloaded script. We’ll look beyond its first 256 bytes to uncover obfuscated commands, embedded data, and the second-stage payload it is designed to execute.

What The Full Script Reveals

Reading the full script, not just its first 256 bytes, can reveal obfuscated commands and embedded data hidden among routine-looking system checks and log messages.

The script uses several standard tools to unpack its embedded second stage:

• md5 derives a decryption key.
• xxd -r -p converts the hexadecimal strings into bytes.
• openssl enc -d -aes-128-ctr decrypts those bytes.
• gunzip decompresses the result.

The script then pipes the result to zsh, which would execute it.

“Unpack its embedded second stage” means transforming data embedded in the first script into another script. Here, the script combines the embedded strings, converts them from hexadecimal to bytes, decrypts and decompresses them, then passes the result to zsh.

A deeper, step-by-step analysis of how to safely inspect every transformation is beyond the scope of this tutorial. But we can still examine the script’s visible structure and explain, in plain language, what it is designed to do without running it.

Here’s how the visible script works:

1. Routine-looking system checks

The script refers to $HOME/Library/Caches, checks available disk space with df, and counts older files with find. It also prints messages such as “preflight ok” and “no action required.”
This is a common psychological trick to make the user or a casual reviewer think it is a safe system script.

2. Obfuscated Command Construction (printf and String Concatenation)

Rather than appearing in plain text, some commands use octal escapes and split strings to hide their true names by chopping words into pieces or writing them as number codes, then assembling them right before execution:

• u166h=$(printf '\155\144\065') produces md5.
• t8bkn=$(printf '\170\170\144') produces xxd.
• tmyb='opens' and s180='sl' combine to form openssl.
• bgmq1=$(printf '\147\165\156\172\151\160') produces gunzip.

This obscures the commands when someone scans the script, although it does not make them impossible to identify.

3. Decrypting and executing a hidden payload

At the very bottom, the script assembles a massive block of hex or binary data stored in variables (_rollout_key, _vendor_ref, and _license_salt). It then constructs a cryptographic decryption pipeline using hidden commands.


Here is what each line is doing in plain English:

• u166h=$(printf '\155\144\065') produces md5.
  Instead of just typing the letters, it uses printf to translate octal number codes (\155 = m, \144 = d, \065 = 5) into those letters and stores them in a variable.
  
• t8bkn=$(printf '\170\170\144') produces xxd.
  Similarly, it uses number codes (\170 = x, \170 = x, \144 = d) to secretly build the word xxd (a tool used for viewing and editing binary files).
  
• tmyb='opens' and s180='sl' combine to form openssl.
  Instead of writing the encryption tool all at once where a security scanner could easily spot it, it splits the word into two separate pieces to be glued together later.
  
• bgmq1=$(printf '\147\165\156\172\151\160') produces gunzip.
  Once again, it uses octal number codes to spell out the file decompression tool letter by letter.

Finally, it pipes | the fully decrypted, hidden payload directly into /bin/zsh to execute it live on the system.

Who Is This Script Targeting

The script appears to target macOS users. Its clearest clue is $HOME/Library/Caches, a standard macOS user cache location that isn’t part of the usual Linux home-directory layout. The #!/bin/zsh shebang and use of tools such as md5, xxd, openssl, and gunzip add context. Together with the download flow, these details point toward a script designed for macOS, though they don’t rule out execution on a Linux system with compatible paths and tools.

It also challenges the old myth that Macs don’t get malware: macOS can be targeted, too. The clues point to macOS as the intended platform, though they don’t rule out execution on Linux. No operating system is immune to malware or compromise, and internet-connected devices face threats that vary by platform.

Why Is This Being Done?

Whoever wrote this code is deliberately trying to hide their tracks. If an antivirus program or a security scanner analyzes the script, it won't see powerful tools like openssl or md5 written out in plain text. Instead, the script only reconstructs and runs those commands after it is already executing on the computer; a classic evasion technique used by malware to sneak past security defenses.

How Hiding Code Bypasses Antivirus Detection

That is a great question.

Why does hiding those words trick a security scanner or an antivirus program in the first place?
It comes down to how these security tools are built.

They rely on two main methods:

1. Signature-Based Scanning

Traditional antivirus programs and basic security scanners work a lot like a facial recognition camera at an airport. They have a massive database of known bad files, malicious signatures, and dangerous keywords (often called "blacklists").

• If a script contains plain text like rm -rf, curl malicious-site.com, or uses openssl to decrypt a hidden payload, the scanner spots those exact words, flags them instantly, and blocks the script.

The trick: By using octal escapes or split strings ('opens' + 'sl'), the words openssl or md5 literally do not exist anywhere in the text of the script file. To a scanner looking for plain text, the file looks clean and ordinary because those "bad" words aren't written down anywhere.

2. Static Analysis (Reading the Code)

Before a script runs, security tools will often "read" through the code to analyze what it might do.

• If a scanner sees a tool meant for decryption or execution (openssl, gunzip, /bin/zsh), it gets suspicious and asks, "Why is this script decrypting hidden data?"

The trick: By keeping the commands scrambled until the very microsecond the script executes in memory, static analysis tools miss the warning signs. The script only puts the puzzle pieces together after it has already bypassed the initial security check.

In short: Security scanners are designed to look for obvious, readable red flags. Obfuscation works because it blinds the scanner's text recognition, allowing malicious code to sneak past the front door disguised as harmless gibberish.

What To Do if You Ran The Command

From a different, trusted device, change important passwords and revoke active sessions, starting with email, financial, and work accounts. If the device belongs to your workplace or school, contact its IT or security team promptly.
For a personal device, consult a reputable security professional. Reinstalling the operating system may be appropriate if the script’s actions cannot be determined.

What We Can Conclude About lyric-59.com and the script

The command downloads a .dat file from lyric-59.com and pipes | it directly into zsh for execution.
The script disguises its behavior with routine-looking cache checks and log messages, then uses xxd, OpenSSL, and gunzip to decode and run a second-stage script. That stage contacts an external server, downloads another file, and launches it.
This is malicious dropper behavior and should be treated as unsafe.

Download the Sample

For educational analysis only. This is an untrusted script, not an installer. Do not run it or open it by double-clicking.

Sample details

• File: suspicious-file.txt
• Size: 3,003 bytes (2.93 KiB)
• SHA-256: 1f3da0c1580df08e51da570f5c1f8b3cde38d3e97d0c94e94f9471c8faa86240
• Status: Untrusted sample; execution disabled

This script is a dropper; a type of malicious program designed to covertly sneak past security defenses and execute another piece of code on a system. The code you see here doesn't do the damage itself; its sole purpose is to decrypt a hidden payload in memory and execute it blindly. Running this script gives an unknown attacker full remote code execution privileges on your computer.
Do not run this script under any circumstances.

We hope this was helpful.
Keep learning. Keep exploring. Build a safer open-source community.