Hook module structure After decrypting the strings, it became clear that the Linux Hook main module communicated with the same CnC server as other Windows modules:  The CNC’s IP address in the Linux module This Linux module can process the following commands, some of which are similar to the Windows version:    die  delete all BlackEnergy2 files and system traces   kill  delete all BlackEnergy2 files and system traces and reboot   lexec  launch a command using bin/sh   rexec  download and launch file using ‘fork/exec’   update  rewrite self file   migrate  update the CnC server    Windows Plugins After the disclosure of an unusual CnC server that pushed Linux and the new Windows plugins we paid greater attention to new BE2 samples and associated CnCs