Figure 11: XML configuration file to schedule the task The Zyklon malware first retrieves the external IP address of the infected machine using the following:  api.ipify[.]org ip.anysrc[.]net myexternalip[.]com whatsmyip[.]com  The Zyklon executable contains another encrypted file in its .Net resource section named tor