To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

Malware Overview
This Trojan may be downloaded from remote site(s) by other malware. It may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web site(s).
When executed, this Trojan drops a copy of itself in the Windows system folder using random file names. It then modifies the Domain Name System (DNS) by modifying a certain registry entry.
Since the DNS is responsible for translating domain names into IP addresses, modifying its settings, along with the system's Internet settings allows the machine to visit various Web sites.
It deletes itself after execution.


More...