Specifically, here's the list of indicators common to v1 & v2, quoted from the article: > ~/Library/._insu (empty file used to signal the malware to delete its

Specifically, here's the list of indicators common to v1 & v2, quoted from the article: > ~/Library/._insu (empty file used to signal the malware to delete itself) > /tmp/agent.sh (shell script executed for installation callback) > /tmp/version.json (file downloaded from from S3 to determine execution flow) > /tmp/version.plist (version.json converted into a property list)