The VB.NET variant then gathers system information and running processes like other Zebrocy variants by running the following commands: systeminfo & tasklist The URL used to send the system information, running processes and a screenshot to the C2 server is: hxxp://109.248.148[.]42/agr-enum/progress-inform/cube.php?res=[serial number] The VB.NET variant of Zebrocy uses an HTTP POST request to the URL above to transmit the gathered data, of which is included within the HTTP POST data that is structured as follows (notice the spaces before and after ampersand “&”): data=[system information and running processes] & arg=[screenshot in BMP format] C# Zebrocy Variant The C# variant of Zebrocy is similar to other variants in functionality, but also has several unique attributes that are worth discussing