C2 Communication Malware C2 servers are stored hardcoded in binary and cannot be changed by operators dynamically, unless the malware’s executable binary is updated. In our binary, there are three hardcoded HTTPS URLs used for C2 communication. These C2 servers’ addresses were not seen in previous versions