As with similar types of malware, the bot runs in the background, allowing MySQL to run normally while it contacts a remote Internet Relay Chat (IRC) server for additional instructions. In the report, Ullrich states that the bots' target IRC server was busy and unable to accept new connections when researchers last attempted to contact it. On earlier attempts, the IRC server showed around 8,500 connections, all of them likely due to infected MySQL installations.