From the 185.25.50[.]93 C2 IP, we discovered another hard-coded user agent being used by Zebrocy: Mozilla/5.0 (Windows NT 6.1; WOW64) WinHttp/1.6.3.8 (WinHTTP/5.1) like Gecko We observed several samples of Zebrocy using this user agent targeting the foreign affairs ministry of a large Central Asian nation