The communication between the malware and the server is based on the HTTP protocol and slightly varies between the samples. Every few seconds the backdoor sends a POST request to the C&amp;C URL. The result is encrypted and sent back to another URL on the server as the parameter of a POST request