To summarize, the Mach-O does the following: Downloads a file from the URL supplied as an argument Decrypts this file using AES-128-EBC and TEA with a custom delta Writes the resulting file to $TMPDIR/airportpaird and makes it executable Uses the privilege escalation exploit to remove the com.apple.quarantineattribute from the file to avoid asking the user to confirm the launch of the unsigned executable