After infecting Fiberhome routers, its sole purpose seems to be setting up SOCKS5 proxies.
Source: Threadpost