VirTool:WinNT/Sinowal.A is a complex component associated with command and control functions and the advanced stealth features of the Win32/Sinowal family.
Win32/Sinowal is a family of password-stealing and backdoor trojans. These trojans may try to find a cryptographic certificate on the infected computer and install a certificate on the computer to mislead users in Secure Sockets Layer (SSL) Web transactions. Some Win32/Sinowal components may also use advanced stealth functionality, or try to perform certain operations from the context of a trusted process such as explorer.exe in order to bypass local software-based firewalls.
Installation
VirTool:WinNT/Sinowal.A features a novel and complex method of infection that it uses in order to compromise affected machines. This infection method is performed in the following manner:
-
VirTool:WinNT/Sinowal.A creates an executable temporary file with the prefix 'ldo'
eg: "c:\Documents and Settings\User\Local Settings\Temp\ldo1.tmp". It then executes this file.
-
It launches itself, using another temporary file with the prefix 'cln' as the parameter
eg: --cp "c:\Documents and Settings\User\Local Settings\Temp\cln2.tmp".
This action creates a copy of the original file and "converts" the file to a DLL.
-
The newly created DLL is then loaded.
It creates the following service:
ServiceName = "{7663B344-A474-4eff-A35D-F5BE7F6531B4}"
DisplayName = ""
StartType = SERVICE_DEMAND_START
BinaryPathName = "%SystemRoot%\System32\svchost.exe -k netsvcs"
and sets the following registry key so the DLL can run as a service:
Adds value: ServiceDll
With data: "c:\Documents and Settings\User\Local Settings\Temp\cln2.tmp"
To subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{7663B344-A474-4eff-A35D-F5BE7F6531B4}\Parameters
-
It starts the service; the service drops a driver to:
"<system folder>\{4C35FFDF-5669-4e96-8F6B-6CE0C16B4331}"
and installs it via the following registry modifications:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{4C35FFDF-5669-4e96-8F6B-6CE0C16B4331}
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{4C35FFDF-5669-4e96-8F6B-6CE0C16B4331}\ImagePath=\??\C:\WINDOWS\System32\{4C35FFDF-5669-4e96-8F6B-6CE0C16B4331}
MBR Modification
The abovementioned mentioned file 'ldo1.tmp' is responsible for modifying the hard disk's MBR (Master Boot Record) and writing the main driver and driver loaders portion directly to disk.
It attempts to access the hard disk directly via a previously installed driver. If this fails, it then reverts to trying to access the hard disk directly via \\.\PhysicalDrive0.
The original MBR is then overwritten with malicious code.
Additionally, the main driver is written to the end of the physical drive, from where it is loaded directly.
Once complete the trojan sleeps for a random period of time between 15 - 30 minutes in length, after which it initiates a system shutdown. The dialog box displaying the countdown timer is hidden from the user.
Payload
Backdoor Functionality
The main driver makes outbound connections via HTTP to the following hardcoded IP address:
74.86.208.140.
Presumably this is to receive instructions and/or register with a remote attacker/overseer. Static analysis suggests that the main component can receive instructions which allow it to act as an HTTP proxy, or to download and execute further malware.
The following domains, which appear to follow a psuedo-random naming convention, may also be contacted in a similar manner:
bxdfwdwx.com
dxbjcgei.com
eebttibt.com
exxhhjws.com
fssdeggs.com
fwwcbckk.com
gdtbbwug.com
gfvwjbfg.com
gxdegigc.com
hjfkgjdd.com
hukvhguw.com
ivdikxeb.com
jcdeekcb.com
kcihugxf.com
khsutwtv.com
kjivuvtv.com
sjeswbuj.com
swhhguvc.com
tdgthcff.com
tgwxtwxj.com
tujxegxs.com
uxcvwugd.com
vbsuxvgk.com
vfwwxjii.com
vjfwfghh.com
wbcbgckw.com
wfvxgxfe.com
wkgbswgk.com
wwugxbik.com
xwujjite.com
For example: http://bxdfwdwx.com/service/
Currently, these domains resolve to the following IP address:
72.5.175.97