This Trojan may arrive bundled with malware packages as a malware component. It may arrive as a .DLL file that exports functions used by other malware.
This Trojan drops the following copy of itself. This Trojan accesses Web sites to download the following files. It accesses Web sites to download the following files.
A downloaded file contains a list of links detected as the following malware:
- TROJ_GAMETHIE.JV
- TSPY_ONLINEG.QBP
- TROJ_ALMANAHE.AC
- TSPY_ONLING.AF
- CRYP_UPACK
