The previous version of this malware was also scanning IP addresses for SMTP service, but this version is only scanning the IP addresses with the help of command and control servers to find out the SSH ports.