It spreads via network drive shares. Its payload is a backdoor that listens on port 7597. It notifies the person who planted the Trojan via e-mail. Contained in that e-mail is the IP address of the infected machine. Now this is a stupid Trojan to unleash on a large company.
Companies have lots of drive shares.
This means lots of infections, which in turn means lots of e-mail, too much. It was all this e-mail that got detected. Right away this points to script kiddie behavior, not the Russian Mafia like The Register is reporting . But if it was the Russian Mafia, I don t think we have much to fear from their technical espionage division. The fact is that this is a common Trojan and a noisy one.