We have no idea about how and when this port was opened yet." It also appears that the worm's propagation is implemented through droidbot, a mining .apk based on Coinhive mining software.