Collect file/folder/drive information - Download files and additional malware - Launch/terminate/enumerate process - Update configuration data - Delete files - Inject code from files to other running process - Utilize proxy - Open reverse shell - Run in passive mode — instead of actively connecting to the command and control (C&C) server, the backdoor will open and listen to a port then receive commands through it