All the strings used by the malware are encrypted and are decrypted by Rijndael symmetric encryption algorithm in the “&lt;Module&gt;.\u200E” function. This function receives a number as an input and generates three byte arrays containing input to be decrypted, key and IV (Figure 6