This Trojan arrives as attachment to email messages spammed by another malware or a malicious user. It may also be downloaded from remote sites by other malware.
Upon execution, this Trojan drops a copy of itself. It then registers itself as a system service to ensure its automatic execution at every system startup. It does this by creating registry keys/entries.
This Trojan accesses URLs to download files which Trend Micro detects as TROJ_AGENT.RH and TROJ_NUWAR.AA.


More...