PWS:Win32/Simda

PWS:Win32/Simda is a family of password-stealing trojans that may also allow backdoor access and control to an affected computer. Its main purpose is to steal passwords and system information from a user's machine.

Installation

PWS:Win32/Simda is a DLL which is injected into the winlogon.exe or explorer.exe processes by Backdoor:Win32/Simda.A.

Payload

Allows backdoor access and control

PWS:Win32/Simda creates the following registry entry in order to allow remote access to a local port:

In subkey: HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List
Sets value: "<port number>:TCP"
With data: "<port number>:tcp"

Where <port number> varies.

PWS:Win32/Simda contacts a remote host at mesosalpinx.com, listens on port <port number> and waits for commands. Using this backdoor, an attacker can perform a number of actions on an affected computer. For example, an attacker may be able to perform the following actions:

• Disable the infected system by deleting critical registry keys
• Force reboot
• Download and execute arbitrary files
• Upload files
• Spread to other computers using various methods of propagation
• Log keystrokes or steal sensitive data
• Modify system settings
• Run or terminate applications
• Delete files

Steals sensitive information

PWS:Win32/Simda is used to obtain sensitive information from the affected computer, and as such, may:

• Monitor and copy clipboard data whenever text is copied to the clipboard
• Log keystrokes via GetMessage API hook
• Store URLs and window titles for all URLs visited by every process
• Parse Internet browser traffic for user names and passwords via API hooks
• Steal certificates

PWS:Win32/Simda periodically checks for the existence of the following files and sends the contents back to the home domain:

• links.log
• pws.txt

The malware parses Internet Explorer and Opera history files looking for secure sites the user has visited.

PWS:Win32/Simda has also been observed:

• Stealing autocomplete saved passwords from Internet Explorer
• Stealing WinSCP (Windows Secure Copy) stored session passwords
• Decrypting stored data from Opera
• Obtaining dial-up passwords
• Creating the following files:
  • sniff.log
  • keylog.txt
  • pass.log
• Holding intercepted plain text traffic login information pertaining to FTP, NNTP, POP3 and POP2
• Key-logging data
• Storing screenshots to <number>.bmp
• Storing passwords as they are saved
• Storing window text for certain windows

Once loaded, PWS:Win32/Simda attempts to inject itself into the following processes, if they are running on the computer:

• svchost.exe
• iexplore.exe
• java.exe
• javaw.exe
• javaws.exe
• opera.exe
• firefox.exe
• maxthon.exe
• avant.exe
• mnp.exe
• safari.exe
• explorer.exe
• isclient.exe
• intpro.exe
• loadmain.exe
• core.exe
• clmain.exe
• core.exe
• safari.exe

Once loaded inside a process, one or more of the following APIs may be hooked:

• AddPSEPrivateKeyEx
• CreateFileW
• CryptEncrypt
• DnsQuery_A
• DnsQuery_UTF8
• DnsQuery_W
• GetClipboardData
• GetFileAttributesExW
• GetFileAttributesW
• GetMessageA
• GetMessageW
• GetWindowTextA
• HttpSendRequestA
• HttpSendRequestExA
• HttpSendRequestExW
• HttpSendRequestW
• InternetCloseHandle
• InternetQueryDataAvailable
• InternetReadFile
• InternetReadFileExA
• InternetReadFileExW
• InternetWriteFile
• InternetWriteFile_0
• PR_Close
• PR_OpenTCPSocket
• PR_Read
• PR_Write
• Query_Main
• RCN_R50Buffer
• TranslateMessage
• WSARecv
• WSASend
• getaddrinfo
• gethostbyname
• inet_addr
• recv
• send
• vb_pfx_import

These APIs are hooked in order to intercept Internet traffic and strip sensitive information from it.

Terminates processes

PWS:Win32/Simda checks for the following window class names, and terminates any processes they belong to:

• random's system information tool - random/random
• +f
• AVP.MainWindow
• Kaspersky Virus Removal Tool 2010
• Malwarebytes' Anti-Malware
• SAM: Autorun Manager
• hijackthis

The malware also blocks traffic to the following websites:

• avast.com
• kaspersky
• drweb
• eset.com
• antivir
• avira
• virustotal
• virusinfo
• z-oleg.com
• trendsecure
• anti-malware

PWS:Win32/Simda may also, via various DNS hooks (depending on browser), redirect traffic to google.com.

Additional information

The malware creates the following mutex:

• Global\{722E3A61-883B-4144-BA81-1F965879E5C9}

Analysis by Matt McCormack