https://www.botnets.fr/index.php?action=history&feed=atom&title=OSX_Kitmos_analysisOSX Kitmos analysis - Revision history2026-10-24T01:44:55ZRevision history for this page on the wikiMediaWiki 1.43.11https://www.botnets.fr/index.php?title=OSX_Kitmos_analysis&diff=2876&oldid=prevEric.freyssinet: 1 revision imported2015-02-07T14:29:56Z<p>1 revision imported</p>
<table style="background-color: #fff; color: #202122;" data-mw="interface">
<col class="diff-marker" />
<col class="diff-content" />
<col class="diff-marker" />
<col class="diff-content" />
<tr class="diff-title" lang="en">
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td>
<td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:29, 7 February 2015</td>
</tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div>
</td></tr>
<!-- diff cache key wiki:diff:1.41:old-2875:rev-2876 -->
</table>Eric.freyssinethttps://www.botnets.fr/index.php?title=OSX_Kitmos_analysis&diff=2875&oldid=prevEric.freyssinet at 16:28, 20 May 20132013-05-20T16:28:44Z<p></p>
<p><b>New page</b></p><div>{{Publication<br />
|Type=Blogpost<br />
|Link=http://blog.sbarbeau.fr/2013/05/osx-kitmos-analysis.html blog.sbarbeau.fr<br />
|Author=Steeve Barbeau<br />
|NomRevue=Steeve Barbeau's blog<br />
|Date=2013-05-20<br />
|Editor=Steeve Barbeau<br />
|Year=2013<br />
|Botnet=HangOver<br />
|Malware=Kitmos<br />
|Abstract=On 16th of May, Sean Sullivan has published an article on F-Secure blog about a new Mac OSX malware discovered on the Mac of an African activist by Jacob Appelbaum during an Oslo Freedom Forum workshop.<br/><br />
<br />
According to file Unix command, this binary is a Mach-o executable containing x86 and x64 code. VirusTotal repport of this binary can be found here. With a really quick look at the sample, we can see that it is not packed, obfuscated or encrypted.<br/><br />
<br />
This sample contains two C&C url which in fact are at the moment pointing to the same server at IP 50.116.28.24 (This differs from F-Secure blog post, where IP addresses of both domains where different). This IP address points to Linode hosting company.<br />
}}</div>Eric.freyssinet