The original variant of  encrypts C2 traffic using a custom encryption cipher that uses an XOR key of “YHCRA” and bit rotation between each XOR operation.  has also included HTML code in C2 traffic in an apparent attempt to evade detection. Additionally, some variants of  use modified SSL code for communications back to C2 servers, making SSL decryption ineffective.