Janicab

Janicab is a macOS malware family operated by Evilnum.

Background

As described by Patrick Wardle, this malware achieves persistence by installing a python script as a cron job. The process works as follows: the python installer first dumps any existing cron jobs into a temporary file at '/tmp/dump', then appends its own entry to that file. Once the new cron job is in place, 'python (~/.t/runner.pyc)' executes every minute.

Source: Malpedia (Fraunhofer FKIE).