This Trojan may be dropped by other malware. It may be downloaded unknowingly by a user when visiting malicious Web sites.
Upon execution, this Trojan drops a copy of itself in the Windows system folder. It then registers itself as a system service to ensure its automatic execution at every system startup.
This Trojan opens random ports and acts as a proxy server which is an intermediary between a user and a server. A proxy usually listens to a port, and when it receives an incoming request, it forwards the said request to the target server. When the proxy receives a reply, it forwards the reply to the original user.
As a proxy server, this Trojan allows a remote malicious user to use the affected system in concealing the said author's identity when performing malicious activities.