This backdoor may arrives as a file dropped by other malware. It may also be downloaded unknowingly by a user when visiting malicious Web sites.
Upon execution, this backdoor drops a copy of itself. It registers itself as a system service to ensure its automatic execution at every system startup. It does this by creating registry keys/entries.
This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user executes commands on the affected system.
This backdoor deletes itself after execution.


More...