
329
10Chapter
The Torpig Trojan Exposed
The Torpig Group, Part 1: Exploit Server
and Master Boot Record Rootkit*
Executive Summary
e iDefense Malicious Code Operations team has conducted extensive research into the
group responsible for carrying out attacks with the Torpig Trojan horse. is code, also
known as Sinowal, is one of the most comprehensive phishing Trojans to date. It targets more
than 900 URLs, including nearly every iDefense financial-sector customer. While analysts
were writing this article, a private forum revealed details about a Trojan utilizing a mas-
ter boot record (MBR) rootkit, which has rightfully gained ...