Recently, the malware used by Lazarus VSingle has been updated to retrieve C2 servers information from GitHub. VSingle malware that obtains C2 server information from GitHub Some types of malware use DGA, obfuscate destination information, or contain fake C2 server information in order to hide the original C2 server. However, when it can not obtain data from them, the malware accesses GitHub to obtain new C2 servers. (Vsingle on Windows OS does not include this update and uses Windows API, not wget command.) While most types of malware in general use system call and/or API to communicate with C2 servers, VSingle dares to execute the wget command, which leaves traces easily.