Once installed, the trojan activates a Remote Access Trojan (RAT), allowing Lazarus operatives to execute commands and maintain persistence on compromised machines. The RAT communicates with a known malicious IP associated with Lazarus Group activity.