Next, remove the attacker's certificate that was added to the system, using the Keychain Access application (certificate name: COMODO RSA Extended Validation Secure Server CA 2). Finally remove tor and socat via HomeBrew (i.e. brew rm FORMULA). If didn't have HomeBrew already installed - meaning the malware installed it, that can be removed as well. Honestly, if infected with OSX/Dok it's suggested you just fully re-install macOS