Rocra sets up a backdoor on the compromised systems, enabling persistent access even after reboots or network changes. Network traffic indicates communication with a known malicious IP and the transfer of a backdoor executable.