[msm_]

> Is that something attackers can install/activate remotely through some kind of RCE, or does it need me to run an executable manually?

This piece of malware is not related to distribution, and must be executed manually (or, more likely, executed by a different malware sample serving as a loader). So you can use it in a social engineering attack, deploy it org-wide after exploiting AD, install it using some kind of RCE, etc.