As before, the malware uses a combination of RSA, RC4 encryption, and HTTPS to communicate with the C&C. An encrypted packet has the following structure: 4-byte CRC, followed by RSA_BLOB. After decrypting RSA (request packets cannot be decrypted without the C&C private key), we get a GZIP packet