One sample in particular, cba5ab65a… used yet another unique user agent string in combination with the previous user agent for its C2: Mozilla v5.1 (Windows NT 6.1; rv:6.0.1) Gecko/20100101 Firefox/6.0.1 A malware sample using two separate unique user agent strings is uncommon