It has obfuscated binary strings including the use of XOR encryption and Base64 encoding. It has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.