{
  "family": "sinowal",
  "sample_count": 13,
  "category": "banking_trojan",
  "description": "Trojan:Win32/Sinowal (widely documented in cybersecurity research as Torpig and its underlying MBR rootkit Mebroot) is a historic, landmark financial crimeware platform first discovered in 2006. Sinowal revolutionized malware stealth by becoming the very first in-the-wild crimeware to infect the Master Boot Record (MBR) of the host hard drive. By executing before the Windows operating system boots, Sinowal bypassed kernel integrity checks (PatchGuard), subverted memory security controls, and established complete operating system invisibility without altering standard system files. Operating as a premier weapon of the Russian Business Network (RBN) crimeware ecosystem, Sinowal injected into explorer.exe to deploy dynamic webinjects that intercepted banking credentials, credit card numbers, and personal identification numbers from more than 500,000 victim accounts across thousands of financial institutions worldwide. In early 2009, an international academic research team from UC Santa Barbara executed a ten-day takeover and sinkhole of the Torpig C2 infrastructure, analyzing over 70 gigabytes of intercepted data and publishing the seminal computer science paper 'Your Botnet is My Botnet'.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Sinowal",
    "Mebroot",
    "Torpig",
    "Anserin",
    "Trojan.Sinowal",
    "Win32/Sinowal"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What was the Sinowal (Torpig / Mebroot) malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sinowal, known as Torpig and Mebroot, was the first crimeware to overwrite the hard drive Master Boot Record (MBR) to achieve pre-boot persistence and steal financial data."
      }
    },
    {
      "@type": "Question",
      "name": "How did Mebroot achieve stealth on Windows?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Mebroot infected the hard drive MBR, hooking disk interrupt 13h before Windows loaded, allowing it to control kernel memory and completely hide its files from the OS."
      }
    },
    {
      "@type": "Question",
      "name": "What was the famous UC Santa Barbara Torpig research takeover?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "In 2009, UCSB researchers took control of Torpig's C2 domain infrastructure for 10 days, capturing 70 GB of stolen credentials and publishing 'Your Botnet is My Botnet'."
      }
    },
    {
      "@type": "Question",
      "name": "How many financial accounts were compromised by Sinowal?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Sinowal compromised over 500,000 online banking, credit card, and identity accounts across more than 400 financial institutions globally."
      }
    },
    {
      "@type": "Question",
      "name": "How is MBR rootkit infection like Sinowal mitigated?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Modern mitigation utilizes UEFI Secure Boot, TPM-backed Measured Boot, and re-flashing or rewriting the Master Boot Record using bootrec /fixmbr from trusted recovery media."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1542.003",
    "T1014",
    "T1185",
    "T1055",
    "T1056.001",
    "T1071.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1542.003",
      "name": "Bootkit",
      "tactic": "persistence"
    },
    {
      "id": "T1014",
      "name": "Rootkit",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "defense-evasion"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "collection"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-14",
  "first_seen": 2006,
  "lineage": {
    "derived_from": [],
    "variants": [
      "sinowal v1 (2006)",
      "mebroot mbr bootkit",
      "torpig modular banker",
      "anserin"
    ]
  },
  "attribution": [
    {
      "actor": "Russian Business Network (RBN) Affiliates",
      "confidence": "high"
    },
    {
      "actor": "Sinowal Syndicate",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2006-0003",
    "CVE-2008-2244",
    "CVE-2010-2568"
  ],
  "c2_profile": {
    "protocols": [
      "HTTP",
      "HTTPS",
      "DNS"
    ],
    "ports": [
      80,
      443,
      53
    ],
    "traffic_identifiability": "medium"
  },
  "iocs": {
    "file_hashes": [
      "1d2c6762391ea2837493a109a927ec0bc1d34c2ab79d67e5ff825c88b64e5257",
      "841893d5f308e7ef9e4345eb6eeecb321a59051d95dc48e77a9497e68db30058"
    ],
    "delivery": [
      "drive_by_downloads",
      "exploit_kits"
    ],
    "persistence": [
      "Master Boot Record (MBR) Overwrite",
      "Disk INT 13h Hook"
    ]
  },
  "sources": [
    {
      "name": "UC Santa Barbara Academic Study: Your Botnet is My Botnet",
      "url": "https://www.cs.ucsb.edu/~seclab/projects/torpig/"
    },
    {
      "name": "Symantec Security Response: Trojan.Mebroot Technical Teardown",
      "url": "https://www.broadcom.com/support/security-center"
    },
    {
      "name": "NIST National Vulnerability Database CVE-2010-2568",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-2568"
    }
  ],
  "containment_steps": [
    "Boot system from trusted external recovery media and execute bootrec /fixmbr to overwrite malicious MBR code.",
    "Enforce UEFI Secure Boot and Measured Boot with TPM 2.0 to prevent pre-boot firmware and boot sector tampering.",
    "Revoke compromised financial credentials and monitor banking accounts for unauthorized wire transfers.",
    "Deploy endpoint detection agents capable of verifying physical disk sector 0 hash integrity."
  ],
  "what_to_avoid": [
    "Do not assume operating system reinstallations remove MBR-resident bootkits without re-partitioning.",
    "Avoid disabling UEFI Secure Boot on enterprise Windows endpoints.",
    "Never ignore anomalous disk sector integrity warnings reported by security monitoring agents."
  ],
  "target_industries": [
    "banking",
    "financial_services",
    "fintech",
    "consumers"
  ],
  "motivation": "Financial Theft & Banking Credential Interception",
  "threat_actors": [
    "Russian Business Network (RBN)",
    "Sinowal Syndicate"
  ],
  "target_geographies": [
    "US",
    "DE",
    "GB",
    "RU",
    "ES",
    "IT"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "persistence",
    "defense-evasion",
    "credential-access",
    "collection"
  ],
  "ecosystem": [
    "windows",
    "x86"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}