Deletes itself

Modifies Watchdog functionality

Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

Traces itself

Traces itself to prevent debugging attempts

Checks files specific to OpenVZ

Checks for local files which indicate if the system is an OpenVZ container.

Checks hardware identifiers (DMI)

Checks DMI information which indicate if the system is a virtual machine.

Enumerates running processes

Discovers information about currently running processes on the system

Reads hardware information

Accesses system info like serial numbers, manufacturer names etc.