Some interesting functions observed in it's behaviour: Uses a fake system authentication prompt to trick the user into entering their password and gain elevated access Uses built-in utilities such as dscl, system_profiler, osascript, ditto, and curl Collects system information and files from various directories such as Desktop, Documents and...