SpeakUp uses POST and GET requests over HTTP to communicate with its main C&C which is the compromised website of speakupomaha[.]com. The first POST packet sends a victim ID and more introductory information such as the current version of the installed script. Afterwards, the Trojan posts “full information” about the machine by executing the following LINUX commands