This backdoor drops files/components.
It registers itself as a system service to ensure its automatic execution at every system startup. It does this by creating registry keys/entries.
It creates registry key(s)/entry(ies). It modifies registry key(s)/entry(ies) as part of its installation routine.
It opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.
It connects to Web sites. It creates mutex(es) to ensure that only one instance of itself is running in memory.


More...