This Trojan may be dropped by other malware.It may be installed manually by a user.It may be downloaded unknowingly by a user when visiting malicious Web sites.
It creates folders.It drops copies of itself.
It creates registry entries to enable its automatic execution at every system startup.It registers itself as a system service to ensure its automatic execution at every system startup. It does this by creating registry keys.
It accesses Web sites to download files. As a result, malicious routines of the downloaded files may be exhibited on the affected system.
However, as of this writing, the said sites are unavailable.
It also restarts the affected system.
Once this Trojan is executed, it asks for a file to be cracked. Upon selecting a file, it displays an error message saying "Incorrect file version".
It then saves the downloaded files in the %Application Data%\m subfolder.