Establish persistence for itself on the endpoint - Establish persistence of another component of the malware on the endpoint - Update itself on endpoint after a separate updater component downloads the update from the control server