ditto
Named by 3 kept items in this workspace.
2 items name it under tools and 1 under classification.key entities.
Search every workspace for ditto. It matches the name as written, so it can find other things that share it.
The items that name it 3
Apple's archiver, used by the malware to archive the stolen-data staging folder into /tmp/osalogging.zip while preserving resource forks (--sequesterRsrc)
macOS archiving utility used by the infostealer to package captured data instead of zip, to avoid detection
All technologies in this workspace.