It exploits at least 12 known vulns, targets random IPs in a subnet, mines XMR, evades detection, and gains persistence.