Its a typical botnet from the looks of things; it listens for commands from a remote server. Only the creator knows what those commands would be. Trojans like this are normally the actual infector. The payload is typically delivered via separate programs that these trojans in turn are triggered to download. That payload could easily be something that steals & encrypts your personal files, demanding a ransom for its return.
Of course it could be programmed to cause a lot of damage on its own - but malware writers have not really been interested in that for a good decade now. The most important thing is to deliver an infector, and only after that actually devise a payload. It gives far more flexibility, and greatly reduces detection rates.
Last edited:
