Knowing not to mount the dmg file, I did the typical MalwareBytes scans, other common scans, and attempted to locate specific files to remove, etc. Some traces of malware were found, so they were removed. Unfortunately, cleaning this wasn't that easy.