TSCookie communicates to C&C servers using HTTP protocol and downloads “a module” and “a loader” for loading the module. The malware has an encrypted DLL file in its resource. When the malware is executed, the DLL file is loaded and executed on memory. The DLL file performs main functions such as communicating with C&C servers. Also, some samples launch another process and inject decrypted DLL file. The malware has configuration information encrypted with RC4, including C&C server information