These samples communicated with the following hosts via FTP for C2 communication:  ftp.byethost7[.]com ftp.byethost10[.]com files.000webhost[.]com  Beginning in June 2018, we observed the OceanSalt malware family being dropped by CARROTBAT