Sinowal

(Botnet) Link to the old Wiki page : [1] / Google search: [2]

Sinowal
Alias	Mebroot, Rootkit MBR, Bootkit (botnet)
Group	Stealing
Parent
Sibling
Family
Relations	Variants: Sibling of: Parent of: Distribution of: Campaigns:
Target	Microsoft Windows, Netherlands
Origin
Distribution vector
UserAgent
CCProtocol
Activity	/
Status
Language
Programming language
Operation/Working group

Features

• Email password theft

• HTTP password theft

• FTP password theft

• Banking credential theft

• Backdoor

• MBR installation

• Rootkit

Publications

	Author	Editor	Year
Dutch users served Sinowal for lunch	Roland Dela Paz	TrendMicro	2012
How to steal a Botnet and what can happen when you do	Richard Kemmerer	Google	2009
One Sinowal trojan + one gang = hundreds of thousands of compromised accountS	RSA FraudAction Research Lab	RSA	2008
Sinowal analysis (Windows 7, 32-bit)	Evild3ad	Evild3ad.com	2012
Sinowal: the evolution of MBR rootkit continues	Andrea Allievi	PrevX Labs	2011
Torpig - Back to the future or how the most sophisticated trojan in 2008 reinvents itself	Andreas Baumhof	Andreas Baumhof	2011
Your botnet is my botnet: analysis of a botnet takeover	Brett Stone-Gross Christopher Kruegel Giovanni Vigna Marco Cova Lorenzo Cavallaro Bob Gilbert Martin Szydlowski Richard A Kemmerer	Department of Computer Science, University of California, Santa Barbara	2009