Vesta Control Panel command injection is one of the several newly included exploits. The version released on May 18 also included Python versions of EternalBlue (CVE-2017-0144) and EternalRomance (CVE-2017-0147) exploits with a Windows download command line as the payload. The addition of new exploits shows that the actor is actively developing new methods of spreading and following the latest vulnerabilities with published PoCs. In the newest instances discovered on May 22, the bot improved its ability to supply credentials for SMB but excluded it from the main exploit function. The usernames and passwords are now in a separate two arrays and extended to include many other usernames and passwords. The exploitation function of this sample does not contain EternalBlue and EternalRomance but attempts to connect over SMB (port 445) and create a service remotely to download and run the main bot file. This latest sample is a pyinstaller-generated sample but is PE file rather than ELF, which was seen previously.