The malware communicates with its C&C server via TCP over the 5200 port. The packets’ payload is encrypted with RC4 using the password “warzone160\x00” (the final null terminator is used as a part of the encryption key