The keylogger will monitor for active application windows and write them to the log in the following format: <span class=’keylog_process’>[Application Name]</span> The keylogger will log a configurable amount of keystrokes (default 50) before sending the log to the C2 server using the following format: <span class=’keylog_user_keys’>[logged keystrokes]</span> The keylogger can handle logging special keys, such as return and the function keys and will report those within the log in the following format; <span class=’keylog_spec_key’>[special character]</span> Infrastructure The XAgentOSX sample we analyzed was configured to use the following IP address and domain names as its C2 servers: 23.227.196[.]215 apple-iclods[.]org apple-checker[.]org apple-uptoday[.]org apple-search[.]info When we analyzed this sample, the domain names that were used as backup C2 locations were not registered; therefore, these domains did not provide any links to additional infrastructure