Check for the existence of these files: ~/Library/._insu (empty file used to signal the malware to delete itself) /tmp/agent.sh (shell script executed for ins

Check for the existence of these files: ~/Library/._insu (empty file used to signal the malware to delete itself) /tmp/agent.sh (shell script executed for installation callback) /tmp/version.json (file downloaded from from S3 to determine execution flow) /tmp/version.plist (version.json converted into a property list) https://redcanary.com/blog/clipping-silver-sparrows-wings/ https://redcanary.com/blog/clipping-silver-sparrows-wings/