How did/would you analyze OSX-Crisis

Question

I was taking a look at the OSX-Crisis sample obtained from this site and trying to analyze it for fun and learning. Choosing to disassemble as a Mac binary causes the start function to be discovered wrongly and hence affect the rest of the disassembly. I was reading the analysis of the malware here, and am curious about how I can go about finding the correct entry point address.

I believe it can be figured out using the LC_UNIXTHREAD command eip value. In this case, should my approach be to disassemble the file within IDA as a "binary"(rather than a mach-o binary), navigate to 0x409c and press "C" ?

Answer 1

According to fG!'s blog entry on OSX-Crisis (recommended read), the true EntryPoint is located in the segment __INIT_STUB, with code execution permission.