This backdoor may be dropped by other malware, specifically TROJ_PIDIEF.GJ.
Upon execution, it will inject its code into a legitimate process. It then drops a copy of itself. This backdoor creates a registry entry to enable its automatic execution at every system startup.
It then uses the system's default browser to open a hidden window. It does this by traversing a registry entry. It uses the said application to open a random TCP port to access a host name.
It then connects to a site. It logs user keystrokes and the title of the active window. It does the said routine to steal information. The stolen information is then saved as %System%\strcpy and later sent once connected.


More...