ASERT Threat Intelligence Brief 2014-07 Illuminating ...

If the C&C is online and responds to the beacon, then the RC4 key is delivered to the bot in a string of base64 encoded characters. Etumbot uses a url-safe base64 alphabet, i.e., any characters that would require URL-encoding are replaced. Usage of base64 is a technique consistent with previous analysis done on IXESHE malware. ................
................