Upon successfully executing, this shellcode stub writes a new file (manifest) to disk with a timestamp 7 days in the future, used to implement a timer after which the malware connects to the C2 infrastructure. After initially connecting to an active C2 server, the malware performs a POST containing a machine identifier. A shellcode stub prepended to the payload used to map it into memory shares similarities with APPLEJEUS loader stubs, which have been associated with DPRK. The CEO of 3CX has recommended uninstalling the software; a small number of community forum posts outline how security tooling is reacting to potential malware behaviors, and CrowdStrike and SentinelOne have published initial information.