This Spyware arrives in the affected system as dropped or downloaded file by other malwares or unsuspecting users,or junk email's attachment.
        It drops a copy of itself in the Windows system folder and creates a folder with attributes set to System and Hidden to prevent users from discovering and removing its components. It modifies a registry entry to enable its automatic execution at every system reboot. It also injects itself into processes as part of its memory residency routine.This Spyware attempts to access a Web site to download file.It maybe steal sensitive online banking information.

It checks for the following processes which are related to Outpost Personal Firewall and ZoneLabs Firewall Client:

• outpost.exe
• zlclient.exe

It creates a copy of itself into %System%\sdra64.exe and add some garbage at the end of it in order to have a different md5 hash thus trying to avoid av detection.

•     %System%\sdra64.exe

It will then create the following folder and files with attributes set to System and Hidden to prevent users from discovering and removing its components:

• %System%\lowsec          -folder
• %System%\lowsec\local.ds
• %System%\lowsec\user.ds  - used to save the gathered information

It hooks API NtQueryDirectoryFile function to hide the files given above.
It trys to inject itself into the all processes as part of its memory residency routine except for csrss.exe processe.
It modifies the following registry entry to enable its automatic execution at system reboot:
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon 

•         Userinit = "%System%\userinit.exe, %System%\sdra64.exe,"

It also creates the following registry entry as part of its installation routine:
     HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network 

•         UID = "{Computer name}_{Random numbers}"

It also creates the following registry entry to disable Windows Firewall:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\SharedAccess\Parameters\ FirewallPolicy\StandardProfile 

•        EnableFirewall = "0"

It connects to following address to download files.
     http://symyho3393245.cn/tmp.dat
when this writting ,the said addresses are already unavailable.