IOC du rapport source : https://www.jamf.com/blog/contagious-interview-trojanized-macos-installers/
Affichage neutralisé. Un observable associé n'est pas une preuve de compromission ni une consigne de blocage.
domain	kikaiverse[.]com	active
domain	lalitae[.]com	active
domain	pobel[.]studio	active
domain	pobelstudio[.]com	active
domain	softcus[.]net	active
domain	w3pi[.]social	active
ipv4	147[.]124[.]202[.]205	revoked
ipv4	162[.]0[.]239[.]85	revoked
sha256	01955691147a036e2104a16f9c3b34d11cb3304e184ed9d533325705599b876b	active
sha256	08425172a2dc19516ba9a3fcca8a0a789962d9b95d1792974f69c086ee64aec9	active
sha256	0882bb158878a1ca19320f5160dc93f4608c862f3ab652671bb92a82b2f1eb39	active
sha256	0d306f347999e02cbbe41d6ff1c47aecbc994213b3cc65bbf4aa723469e6e5ab	active
sha256	0e12f41c2d3d2e48b5a004bff4c126bf8e907bc6c20648f3844ed4ebad126a29	active
sha256	1abbdeee6d03894c0c53240f7ba873fadf9367e312ada1d280420bc88f986e91	active
sha256	24a252e72d767d62f3076f4f59780511288ea9eedd0e30f234c9cdd5b7644cbf	active
sha256	3a7fedfeb42f13b2c368c195ec83b8e8c952df7fd506133210868f3eeb06b51d	active
sha256	3cda9d3522d471a0018bc58499a424f8084b29e21776d8d63d09fe2d7eca4b49	active
sha256	42620128470e26d473a128f354b77ca2c5fe9e5782e7addc1e3f863dbd0cd9b0	active
sha256	46d382b234dcd63e66b17799b2e6cefe24ae60e10bef758c6ccf8e72ba0aaa6c	active
sha256	4c025bda19d6b7b1f9cc209876099b20130a198c18ae22b7809470dde93c62db	active
sha256	5ab8c5808cc00825c608027d7da8611a5386de65a724fed999828310b3cb4ddb	active
sha256	6b33812538be1983c94cedc82f480fd98b7ccdd3df7fa4fda863262818d07ba1	active
sha256	7030b07575e3c6558fecfd1cabc7463f10c7ca37262da7e57221a85464b7982d	active
sha256	791f2c56e945a2b6e99d93b10e6f42c383aa9a083ae98fc74f8720f92789c645	active
sha256	815a41a0c0426ffec3c9ad08e1fb125a040cf0e41acce2a86b891aeb08648d61	active
sha256	89d36570b91f59f78eaaafba19e91032dce3e6b42d4b7905d38724399bb8c8c2	active
sha256	9ff8a6e839ebfaa185fbd53c35f1e671fe9ce6851738df07d086cae67db3e06a	active
sha256	ab5e0684869238c1a1cabadfa0b2e4351490a6343d210ad09c09455ed352b338	active
sha256	b07f46962c409cb854e34e06abcfc616edcc5a554a43cfac8f4f26cb818a340d	active
sha256	d55d6419b20e7bf07025d3e464cd4bc05bc96216bf5f85dd7f9a4cbdba10d8ea	active
sha256	d9f6c4e60ca24364751e9a3f1550f3600726cb5d185407bc82078aa95ef09e53	active
sha256	e328e5ecf66ac5989aa5f8fb2a7c742d475647b53c929df544b6128db16750d6	active
sha256	ed3cfda8fcd1936777e3ebabb9a307325c4c2cd793416386c80bf906e4df279b	active
sha256	f5686109776f83123d30568e552708a7ad78964396d0f3bfd37d0332f44f8ad6	active
sha256	f9e29c72088f4a7f7789755cd08057f0125c42b352187951623d9290ed0ace1f	active
sha256	fab2e8e1ac22c5d14fd6531efe4e8e05ca9246786154b2d2f3b7f425777f4818	active
url	hxxp[:]//147[.]124[.]202[.]205/api/service/makelog	revoked
url	hxxp[:]//162[.]0[.]239[.]85[:]3000/task/package[.]json	revoked