Napolar.A copies itself to <start menu>\Programs\Startup\lsass.exe to make sure it runs every time you start your PC.It hides this file using a rootkit technique so you might not be able to see it. Note that a legitimate file also named lsass.exe exists by default in <system folder>.
The trojan exits immediately if it detects that it is running under a debugger.
Downloads other malware
Napolar.A runs in explorer.exe and tries to connect to a command and control server to report infection and get instructions. We have seen it connect to the server www.xzy25.comand sunnyamk.com.