Cari Artikel Lainnya

W32/Sality.AA Virus

    About three weeks ago, I got some troubles with my laptop. This was after I plugged a USB FlashDisc into it. I clicked a random file in the USB Disc, stupid me, I didn't scan it before. As a result, there were 2 kinds of virus infected my laptop, the first one should still be considered as worm I guess. But the second one was a real threat to my laptop. It was SALITY !!!! 
    Indeed, this was also caused by my stupidity for neglecting the importance of AntiVirus. Hence, to avoid the same thing happens to you, guys, I suggest to use these AntiViruses :
Moreover, for you who often connect your PC or laptop to the internet. Those AntiViruses will be your PC/laptop's protectors from viruses' threat.
    You might think that I'm just promoting others' products.  Well yeah, I was also a person who was not really care about AntiViruses. But SALITY  changed my mind afterwards. 
     Just to share you my experience, I worked hard to get rid of SALITY  for the virus was really annoying me. With an assistance from a colleague, UCILELEK, I and him had to stay awake for the whole night, just to kill it
TEMPORARILY, as I thought it was solved but unfortunately appeared again and spread a massive threat just the day after. Damn !!!
    SALITY even ruined most of my Program masters and saved games. What a threat, ha?? Anyway, to answer my curiosity about SALITY,  I managed to get more info about it. Here is what I found, just if you, guys, want to know more about it.
Continuing my previous post on SALITY VIRUS, here I would like to share some other facts about it which i just found.
=============================================================
Profile:
Name                    : Virus:W32/Sality.AA
Detection Names   : Virus.Win32.Sality.aa
                              Win32.Sality.OG
Alias                      : W32.Sality.AE (Symantec)
                              Virus:Win32/Sality.AM (Microsoft)
Category               : Malware
Type                      : virus
Platform                : W32
===========================================================================
Sality W32 is a typically program that secretly and maliciously integrates itself into program or data files. It spreads by integrating itself into more files each time the host program is run. It creates  op1mutx9.


In registry modifications, Sality  mutates these values:
===========================================================================
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    GlobalUserOffline = 6684751
  • HKLM\Software\Microsoft\Windows\CurrentVersion\policies\system
    EnableLUA = 6422625
    [Vista User Access Control Disabled]
  • HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    [malware path] = [malware path]:*:Enabled:ipsec
    [Windows Firewall Disabled]
  • HKCU\Software\user914\1214104697
    1919251317 = 3276857
  • HKCU\Software\user914\1214104697
    -456464662 = 3407926
  • HKCU\Software\user914\1214104697
    1462786655 = 3604530
  • HKCU\Software\user914\1214104697
    -912929324 = 3735602
  • HKCU\Software\user914\1214104697
    1006321993 = 3342390
  • HKCU\Software\user914\1214104697
    -1369393986 =    0600687474703A2F2F7777772E6D7573696B72616A742E736B2F6D61696E662E
   67696600687474703A2F2F6D616365646F6E69612E6D79312E72752F6D61696E682E676966006874
   74703A2F2F6A7273782E6A72652E6E65742E636E2F6C6F676F732E67696600687474
  • HKCU\Software\user914\1214104697
    549857331 =    865E52A75BF33F5D5AA15DAFA722193EDDA8540E6C496C04CF492EF296AFD1AFD
   EDBC79CEA25E0F6F53B2D9CC0FA963F3A4CC745615E85AFE1E18AEA7E620D11174F3892E84
   B5B5DD288784938E304B2D65C454E833D6AF929809110987E5B4B3E4D581071DA4948CB9F84
  • HKCU\Software\user914
    u1_0 = 655360
  • HKCU\Software\user914
    u2_0 = 655360
  • HKCU\Software\user914
    u3_0 = 655360
  • HKCU\Software\user914
    u4_0 = 655360
  • HKLM\Software\Microsoft\Tracing\FWCFG
    EnableFileTracing = 7471188
  • HKLM\Software\Microsoft\Tracing\FWCFG
    EnableConsoleTracing = 7471188
  • HKLM\Software\Microsoft\Tracing\FWCFG
    FileTracingMask = 7209065
  • HKLM\Software\Microsoft\Tracing\FWCFG
    ConsoleTracingMask = 7209065
  • HKLM\Software\Microsoft\Tracing\FWCFG
    MaxFileSize = 7077993
  • HKLM\Software\Microsoft\Tracing\FWCFG
    FileDirectory = %windir%\tracing
  • HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    EnableFirewall = 7471209
    [Windows Firewall Disabled]
  • HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    DoNotAllowExceptions = 7340133
  • HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    Hidden = 4718592
  • HKCU\Software\Microsoft\Windows\CurrentVersion\policies\system
    DisableTaskMgr = 6357076
    [Task Manager Disabled]
  • HKCU\Software\Microsoft\Windows\CurrentVersion\policies\system
    DisableRegistryTools = 7929970
    [Registry Editor Disabled]
  • HKLM\SOFTWARE\Microsoft\Security Center
    AntiVirusOverride = 6619254
  • HKLM\SOFTWARE\Microsoft\Security Center
    AntiVirusDisableNotify = 5111909
    [Alerts for no Antivirus Disabled]
  • HKLM\SOFTWARE\Microsoft\Security Center
    FirewallDisableNotify = 5111909
    [Alerts for no Firewall Disabled]
  • HKLM\SOFTWARE\Microsoft\Security Center
    FirewallOverride = 6619254
  • HKLM\SOFTWARE\Microsoft\Security Center
    UpdatesDisableNotify = 5111909
    [Alerts for no Windows-Updates Disabled]
  • HKLM\SOFTWARE\Microsoft\Security Center
    UacDisableNotify = 5111909
  • HKLM\SOFTWARE\Microsoft\Security Center\Svc
   AntiVirusOverride = 6619254
  • HKLM\SOFTWARE\Microsoft\Security Center\Svc
    AntiVirusDisableNotify = 5111909
    [Alerts for no Antivirus Disabled]
  • HKLM\SOFTWARE\Microsoft\Security Center\Svc
    FirewallDisableNotify = 5111909
    [Alerts for no Firewall Disabled]
  • HKLM\SOFTWARE\Microsoft\Security Center\Svc
    FirewallOverride = 6619254
  • HKLM\SOFTWARE\Microsoft\Security Center\Svc
    UpdatesDisableNotify = 5111909
    [Alerts for no Windows-Updates Disabled]
  • HKLM\SOFTWARE\Microsoft\Security Center\Svc
    UacDisableNotify = 5111909
===========================================================================
In addtion, sality W32 is an appending file infector virus that uses an entry point obscuring technique to hide its presence on the system. What's sophisticated is that Sality has the ability to download and install additional malware on the system. Moreover, can also terminate the running AntiVirus program.

When Sality has infected your computer or laptop,  [System]\drivers\[random].sys is dropped into the system and will be detected as Virus.Win32.Sality.ab.
Soon it will copy itself to removable drives and shared folders as one of the following :
 • [randomname].exe
 • [randomname].pif
 • [randomname].cmdt
 After that Autorun.inf will be formed so that he malware will be executed when it is connected to a computer.
It also modifies %windir%\SYSTEM.INI by adding the following section : 
• [MCIDRV_VER]
DEVICE=[random alphanumeric string]

Once on the system, the virus searches the hard disk (starting with C:\) and infects any files with the following extensions:
  • .exe
  • .scr
It also infects files with .EXE extensions that are referenced as data in the following registry keys:
  • [HKCU\Software\Microsoft\Windows\CurrentVersion\run]
  • [HLKM\Software\Microsoft\Windows\CurrentVersion\run]
The virus  appends itself by creating a new 73728 bytes sized section named "[random characters]data". The section contains Sality.AA's obfuscated code.

When run, Sality.AA creates a mutex to ensure only one instance is running. It then modifies a large range of registry entries. The virus attempts to disable processes and services containing strings related to major antivirus software.

The malware connects to the following website to verify an Internet connection

  • http://www.microsoft.com


The malware may connect to the following sites to download and execute additional malware :

  • http://kukutrustnet777.info/[...].gif
  • http://kukutrustnet888.info/[...].gif
  • http://kukutrustnet987.info/[...].gif
  • http://www.musikrajt.sk/[...].gif
  • http://macedonia.my1.ru/[...].gif
  • http://jrsx.jre.net.cn/[...].gif
  • http://www.musikrajt.wz.cz/[...].gif
  • http://www.solidarnosc.org.pl/lublin/[...].gif
  • http://gotcha.goldeye.info/[...].gif

Downloaded files are encrypted. They are unencrypted by the malware to the %temp% folder and executed.

The following URLs may possibly be used to get further instructions:

  • http://89.119.67.154/[...]/
  • http://klkjwre77638dfqwieuoi888.[...]/
  • http://kukutrustnet777888.[...]/

*** PS: I had to re-install my OS for SALITY had too much ruined my systems and programs

Artikel Serupa:

Cari Artikel dari Google: