Transmits payloads in modified RC4-encrypted chunks. This hardens the encryption of the network communication, as a single RC4 key will not decrypt the entire payload. Clears the host’s DNS cache every time it attempts to connect to its C2 server, thereby requiring that the host resolve the current IP address for the malicious C2 domain each time. Generates unique session keys for each connection to the C2 server. Obscures its connection protocol by connecting to the C2 server over a common port (443), thereby blending in with normal SSL network traffic. Uses position independent code (PIC) to throw off static analysis tools