tokens: The Conversations modified samples differ from the original one in the getKnownHosts method that was modified to replace the main XMPP host with the attackers ’ C2 server : It appears that the attackers were using a specific C2 for the use of that app .