IOC du rapport source : https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/
Affichage neutralisé. Un observable associé n'est pas une preuve de compromission ni une consigne de blocage.
domain	ferncore13[.]com	active
domain	getmacouscloud[.]com	active
domain	grove-89[.]com	active
md5	121cc0f6c933f928273a8d259262e3bd	active
md5	3106cffb9da7380fcc0237e8fde0efa0	active
md5	65334575232f8d94fde18e89af393212	active
md5	e634d35d6ae98935c51de5a23a92e965	active
sha1	2849fe272d6edfdf75c1169102ea7a33d224eb7b	active
sha1	2c78ad15bec38dd235f1a0f91a8ec71ecdf2701b	active
sha1	65b02a832483a5fa367d96c36c56372722e752cc	active
sha1	739afb0e43501a8aa6e4322fafb6841a880f0271	active
sha256	4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9	active
sha256	608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688	active
sha256	6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620	active
sha256	71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c	active
sha256	7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a	active
sha256	a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9	active