The XOR key used to encrypt the data is saved into the blob in an encoded form. The hard-coded key used for encrypting data is stored in the blob. The encrypted key is used to encode the data using an encoded key 0x0E150722. The data is encrypted using an encrypted key and the key is sent to a safe key. The key is encoded with a secret key to encrypting the data. The encryption key is then used to send the encrypted data to an encrypted blob.”]
Source: https://baesystemsai.blogspot.com/2015/06/new-mac-os-malware-exploits-mackeeper.html