To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.



Malware Overview

This Trojan may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.

It creates a folder and drops several files, some of which are detected as the following:

• TSPY_POPHOT.QF
• TROJ_POPHOT.QO

It then creates a registry entry to enable the automatic execution of a dropped file at system startup.



More...