This backdoor may be downloaded from remote sites by other malware. It may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.
It may be used by other malware as a component file for their own routines. This backdoor stays memory-resident by injecting codes into a certain processes.
It then opens a hidden Internet Explorer window. It also opens random ports and connects to a certain IP address. This routine allows a remote malicious user to connect to the affected machine, thus compromising system security. However, it deletes itself after execution.


More...