Alert level

VirTool:WinNT/Sinowal.A


Encyclopedia entry
Updated: Jun 05, 2008  |  Published: Jan 10, 2008

Aliases
Not available

Alert Level (?)
Severe

Antimalware protection details
Microsoft recommends that you download the latest definitions to get protected.
Detection initially created:
Definition: 1.45.287.0
Released: Oct 07, 2008

Summary

VirTool:WinNT/Sinowal.A is a complex component associated with command and control functions and the advanced stealth features of the Win32/Sinowal family.
 
Win32/Sinowal is a family of password-stealing and backdoor trojans. These trojans may try to find a cryptographic certificate on the infected computer and install a certificate on the computer to mislead users in Secure Sockets Layer (SSL) Web transactions. Some Win32/Sinowal components may also use advanced stealth functionality, or try to perform certain operations from the context of a trusted process such as explorer.exe in order to bypass local software-based firewalls.

Top

Symptoms

Due to its advanced stealth features, there may be no discernable symptoms of a VirTool:WinNT/Sinowal.A infection.

Top

Technical Information (Analysis)

VirTool:WinNT/Sinowal.A is a complex component associated with command and control functions and the advanced stealth features of the Win32/Sinowal family.
 
Win32/Sinowal is a family of password-stealing and backdoor trojans. These trojans may try to find a cryptographic certificate on the infected computer and install a certificate on the computer to mislead users in Secure Sockets Layer (SSL) Web transactions. Some Win32/Sinowal components may also use advanced stealth functionality, or try to perform certain operations from the context of a trusted process such as explorer.exe in order to bypass local software-based firewalls.
Installation
VirTool:WinNT/Sinowal.A features a novel and complex method of infection that it uses in order to compromise affected machines. This infection method is performed in the following manner:
 
  1. VirTool:WinNT/Sinowal.A creates an executable temporary file with the prefix 'ldo'
    eg: "c:\Documents and Settings\User\Local Settings\Temp\ldo1.tmp". It then executes this file.
  2. It launches itself, using another temporary file with the prefix 'cln' as the parameter
    eg: --cp "c:\Documents and Settings\User\Local Settings\Temp\cln2.tmp".
    This action creates a copy of the original file and "converts" the file to a DLL.
  3. The newly created DLL is then loaded.
    It creates the following service:
    ServiceName = "{7663B344-A474-4eff-A35D-F5BE7F6531B4}"
    DisplayName = ""
    StartType = SERVICE_DEMAND_START
    BinaryPathName = "%SystemRoot%\System32\svchost.exe -k netsvcs"
    and sets the following registry key so the DLL can run as a service:
    Adds value: ServiceDll
    With data:  "c:\Documents and Settings\User\Local Settings\Temp\cln2.tmp"
    To subkey: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{7663B344-A474-4eff-A35D-F5BE7F6531B4}\Parameters
  4. It starts the service; the service drops a driver to:
    "<system folder>\{4C35FFDF-5669-4e96-8F6B-6CE0C16B4331}"
    and installs it via the following registry modifications:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{4C35FFDF-5669-4e96-8F6B-6CE0C16B4331}
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\{4C35FFDF-5669-4e96-8F6B-6CE0C16B4331}\ImagePath=\??\C:\WINDOWS\System32\{4C35FFDF-5669-4e96-8F6B-6CE0C16B4331}
 
MBR Modification
The abovementioned mentioned file 'ldo1.tmp' is responsible for modifying the hard disk's MBR (Master Boot Record) and writing the main driver and driver loaders portion directly to disk.
 
It attempts to access the hard disk directly via a previously installed driver. If this fails, it then reverts to trying to access the hard disk directly via \\.\PhysicalDrive0.
 
The original MBR is then overwritten with malicious code.
 
Additionally, the main driver is written to the end of the physical drive, from where it is loaded directly.
                 
Once complete the trojan sleeps for a random period of time between 15 - 30 minutes in length, after which it initiates a system shutdown. The dialog box displaying the countdown timer is hidden from the user.
 
Payload
Backdoor Functionality
The main driver makes outbound connections via HTTP to the following hardcoded IP address:
74.86.208.140.
Presumably this is to receive instructions and/or register with a remote attacker/overseer. Static analysis suggests that the main component can receive instructions which allow it to act as an HTTP proxy, or to download and execute further malware.
 
The following domains, which appear to follow a psuedo-random naming convention, may also be contacted in a similar manner:
bxdfwdwx.com
dxbjcgei.com
eebttibt.com
exxhhjws.com
fssdeggs.com
fwwcbckk.com
gdtbbwug.com
gfvwjbfg.com
gxdegigc.com
hjfkgjdd.com
hukvhguw.com
ivdikxeb.com
jcdeekcb.com
kcihugxf.com
khsutwtv.com
kjivuvtv.com
sjeswbuj.com
swhhguvc.com
tdgthcff.com
tgwxtwxj.com
tujxegxs.com
uxcvwugd.com
vbsuxvgk.com
vfwwxjii.com
vjfwfghh.com
wbcbgckw.com
wfvxgxfe.com
wkgbswgk.com
wwugxbik.com
xwujjite.com
 
For example: http://bxdfwdwx.com/service/
 
Currently, these domains resolve to the following IP address:
72.5.175.97

Top

Prevention

Take the following steps to help prevent infection on your system:
  • Enable a firewall on your computer.
  • Get the latest computer updates.
  • Use up-to-date antivirus software.
  • Use caution with attachments and file transfers.
Enable a firewall on your computer
Use a third-party firewall product or turn on the Microsoft Windows XP Internet Connection Firewall.
To turn on the Internet Connection Firewall in Windows XP
  1. Click Start, and click Control Panel.
  2. Click Network and Internet Connections. If you do not see Network and Internet Connections, click Switch to Category View.
  3. Click Change Windows Firewall Settings.
  4. Select On.
  5. Click OK.
To turn on the Windows Firewall in Windows Vista
  1. Click Start, and click Control Panel.
  2. Click Security.
  3. Click Turn Windows Firewall on or off.
  4. Select On.
  5. Click OK.
Get the latest computer updates
Updates help protect your computer from viruses, worms, and other threats as they are discovered. You can use the Automatic Updates feature in Windows XP to automatically download future Microsoft security updates while your computer is on and connected to the Internet.
To turn on Automatic Updates in Windows XP
  1. Click Start, and click Control Panel. 
  2. Click System.
  3. Click Automatic Updates.
  4. Select a setting. Microsoft recommends selecting Automatic. If you do not choose Automatic, but you choose to be notified when updates are ready, a notification balloon appears when new downloads are available to install. Click the notification balloon to review and install the updates.
Use up-to-date antivirus software
Most antivirus software can detect and prevent infection by known malicious software. To help protect you from infection, you should always run antivirus software that is updated with the latest signature files. Antivirus software is available from several sources. For more information, see http://www.microsoft.com/protect/computer/viruses/vista.mspx.
Use caution with attachments and file transfers
Exercise caution with e-mail and attachments received from unknown sources, or received unexpectedly from known sources.  Use extreme caution when accepting file transfers from known or unknown sources.

Top

Recovery

If you suspect that your system has been affected with this malware, you may need to write a known-good copy of the Master Boot Record back to the disk to prevent the malware's driver from being loaded on the next reboot. This can be accomplished by using the Windows Recovery Console.
 
Please see the following articles for further detail on using the Windows Recovery Console:
 
When the MBR has been successfully restored, run a full-system scan with an up-to-date antivirus product such as the Microsoft online scanner (http://safety.live.com). For more information, see http://www.microsoft.com/protect/computer/viruses/vista.mspx.

Top