<div align="justify">Trend Micro threat researchers post findings and analyses on various threats in real-time at the Malware Blog. Users can find more information about this specific threat here.

To get a one-glance comprehensive view of the behavior of this malware, refer to the Behavior Diagram shown below.

Malware Overview
This backdoor may be dropped by TROJ_SINOWAL.CB.
It looks for the bootable drive of the affected system. Once found, it copies the original Master Boot Record (MBR) and saves it to another location in the hard disk. It then modifies the MBR by inserting its malicious code.
It also saves some of its malicious code in other portion of the hard disk. As a result, data of the files saved in the said portion is replaced.
It creates a registry entry to enable its automatic execution at every system startup.
This backdoor also drops a rootkit component on the affected system. The said component modifies certain sectors of the infected hard disk. It then protects these sectors from read and write operations from AV/security software.


More...