The remote access trojan mimics legitimate computer activity to make it harder to detect, the researchers said.