To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

Malware Overview
This memory-resident Trojan arrives on a system as an attachment to email messages spammed by another malware or a malicious user. It may also be downloaded unknowingly by a user when visiting a certain malicious Web site.
Below is a screenshot of the said email spam:

When executed, it drops copies of itself. It then modifies the affected system's registry to ensure its automatic execution at every system startup.
This Trojan connects to certain Web sites to download and execute files. Trend Micro detects these files as TROJ_AGENT.NMB and TROJ_AGENT.FZL. As a result, routines of the downloaded Trojans are also exhibited on the affected system.


More...