This Trojan may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.
This Trojan then creates a registry entry to enable its automatic execution at every system startup.
It downloads a .TXT file which contains links. The said .TXT file is then used to download more malicious files, which Trend Micro detects as the following:

• TROJ_AGENT.AIWU
• TSPY_ONLNEG.AL
• TROJ_AGENT.AIWV
• TROJ_AGENT.AIWP

It then executes the downloaded files. As a result, malicious routines of the downloaded files are exhibited on the affected system.


More...