It then contacts a command and control server where it obtains a public RSA key; the server keeps the private key.
It then contacts a command and control server where it obtains a public RSA key. The server keeps the private key.