The malware worked by interleaving viral code into binary code, deserialised and disassembled by the marshal module of Python. The module then reassembled and serialised the infected code.