Command  Action    sign  Requests system information    settings  Requests settings from C2 server    logs  Uploads harvested passwords    wallet  Uploads harvested cryptocurrency wallet data    proxy  Indicates SOCKS proxy port opened    miner  Cryptocurrency miner commands    error  Reports errors to C2 server    ddos  DDoS attack commands    Table 1: Zyklon accepted commands The following figures show the initial request and subsequent server response for the “settings” (Figure 13), “sign” (Figure 14), and “ddos” (Figure 15) commands