This specific module appears to have been put together from public sources with some added functionality from the attackers. Perhaps the most interesting part here is the unusual command and control mechanism based on TCP/UDP packets, as well as the C&amp;C hostname which fits previously known Turla activity