This backdoor may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

This backdoor drops several files. This backdoor is injected in a system process. It registers itself as a Browser Helper Object (BHO) to ensure its automatic execution every time Internet Explorer is run.

This backdoor opens a random port to allow a remote user to connect to the affected system. Once a successful connection is established, the remote user is able to execute commands on the affected system.



More...