PWS:Win64/Sinowal.gen!B is a component of the Win32/Sinowal family.
Win32/Sinowal is a family of password-stealing and backdoor trojans. These trojans may to steal sensitive information by disrupting SEcure Socket Layer (SSL) transactions (those that use certificates) from your computer. Some Sinowal components may also be able to hide or disguise themselves to avoid detection, and perform operations pretending to be trusted processes, such as "explorer.exe", to bypass your computer's security defences.
Installation
When run, PWS:Win64/Sinowal.gen!B drops a payload component as a DLL file in the "%Systemdrive%\ProgramData\Windows\" folder. The DLLcomponent may have any of the following file names:
- lmbd.dll
- mmdd.dll
- mscc.dll
- msdd.dll
- msdr.dll
- msee.dll
- msseedir.dll
- mswd.dll
- wsse.dll
This file is detected as PWS:Win64/Sinowal.gen!A
PWS:Win64/Sinowal.gen!B also create a DAT file in the same folder, which contains data used by its DLL component. The DAT file may have any of the following file names:
- bass.dat
- ccdxmmde.dat
- colu.dat
- dfdd.dat
- drss.dat
- dsdd.dat
- du44.dat
- dumd.dat
- elct.dat
- ffxd.dat
- i3u4.dat
- ii33.dat
- jdlr.dat
- kdkd.dat
- msxx.dat
- ned9.dat
- nudr.dat
- qnud.dat
- rexx.dat
- rrxx.dat
- ssde.dat
- uloc.dat
- vvve.dat
- werr.dat
- wjdj.dat
- xdor.dat
- xes2.dat
- xessmsxe.dat
It registers its DLL component as a Copy Hook Handler by creating the following registry subkeys:
- HKCR\CLSID\<GUID>\InprocServer32
- HKCU\Software\Classes\CLSID\<GUID>\InprocServer32
where <GUID> can be any one of the following:
- {118BEDCC-A901-4203-B4F2-ADCB957D1887}
- {312BED3C-A901-4203-B4F2-ADCB957D1887}
- {F12BE2CC-A901-4203-B4F2-ADCB957D1887}
- {312BFDCE-A901-4203-B4F2-ADCB957D1887}
- {212B3DCC-A901-4203-B4F2-ADCB957D1887}
- {A12BEDCC-A901-4203-B4F2-ADCB957D1887}
It also creates the subkey:
- HKLM\Software\Classes\Directory\Shellex\CopyHookHandlers\<copy hook name>
where <copy hook name> can be any one of the following:
- Copier
- CopierMircosoft
- MicrosoftCopy
- MSCopy
- MSCPY
- WindowsCopy
It may create an event with any of the following names:
- bass1883hr
- bass9883hd
- d2dd9883hr
- dfdd9883hd
- dfed988ehr
- dsdd9883hd
- du3d9813hr
- dumd9883hd
- ffxd3883hr
- ffxd9883hd
- mrxx9883hr
- msxe9883hd
- msxea883ar
- msxx9883hd
- rexx9883hd
- rexx9883hr
- ssde9483hr
- ssde9883hd
- xess9883hd
- xess9883hr
Payload
Steals sensitive data or provides stealth functionality
Files detected as PWS:Win64/Sinowal.gen!B may have different functions. In the wild, they have been observed to steal sensitive data, or provide stealth functionality, allowing them and other Sinowal components to avoid detection. In the process of providing stealth, it also provides backdoor functionality that allows a remote attacker to access and control your computer.
Contacts remote servers
PWS:Win64/Sinowal.gen!B may contact remote servers, such as the following:
- 206.225.82.45
- 5.10.65.138
- 65.23.129.102
- 66.199.234.170
- 69.65.43.70
- boababsshake.pro
- gipolaretsr.info
- jiqtreabopas.com
- kiplonafrey.info
- lospaherata.com
- objectionableboosting.info
- voloferad.info
Analysis by Marian Radu
