This Trojan arrives as a file dropped by other malware. It may also be downloaded by an unsuspecting user when visiting malicious Web sites.
Upon execution, it file drops a copy of itself in the current user's Temporary folder.
It modifies the HOSTS file resulting in redirecting the user to a certain IP address whenever any of certain banking-related sites are accessed.
It also opens a spoofed login page when a user accesses any of the monitored Web sites.
It attempts to retrieve information related to Mexico?s Banamex. It steals user names and passwords used in the aforementioned Web sites.
It uploads stolen information to a certain IP address.

More...