View source for Sinowal: MBR rootkit never dies! (and it always brings some new clever features)

{{Publication
|Image=Sinowal_MBR_rootkit_never_dies.png
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.itsec.it/2012/06/06/sinowal-mbr-rootkit-never-dies-and-it-always-brings-some-new-clever-features/
|Site=www.itsec.it
|Author=Andrea Allievi , 
|NomRevue=
|Date=June 6, 2012
|Editor=ITsec
|Year=2012
|ISBN=
|Page=
|Abstract=In this short analysis paper I want to give a technical overview about one of the latest MBR rootkit updates. The sample which is going to be analyzed is dated April 2012.
Bootkit Loader
The bootkit part of this rootkit remain almost the same as the one that we have just seen in my previous analysis (available here). Sinowal uses the same algorithm to recover the start sector where it’s storing its loader and the main executable file – Last MBR partition sector + 1 for loader and Last MBR partition sector + 0×19 for the main rootkit driver. It hooks Int13h, then hooks BlOsLoader function from NT OS loader, and finally IoInitSystem API from Windows kernel
|Botnet=Torpig, 
|Malware=, 
|CCProtocol=, 
|Operation=, 
|Keyword=, 
}}