Eric.freyssinet: Text replacement - "p2p" to "P2P"

2015-08-12T03:29:55Z

Text replacement - "p2p" to "P2P"

← Older revision		Revision as of 03:29, 12 August 2015
Line 24:		Line 24:
	\|Botnet=Sality,		\|Botnet=Sality,
	\|Malware=Sality_(bot),		\|Malware=Sality_(bot),
	\|CCProtocol=~~p2p~~,		\|CCProtocol=P2P,
	\|Operation=,		\|Operation=,
	\|Keyword=,		\|Keyword=,
	}}		}}

Eric.freyssinet: Text replacement - " www.symantec.com" to ""

2015-08-05T19:51:27Z

Text replacement - " www.symantec.com" to ""

← Older revision		Revision as of 19:51, 5 August 2015
Line 5:		Line 5:
	\|Licence=		\|Licence=
	\|Video=		\|Video=
	\|Link=http://www.symantec.com/connect/blogs/all-one-malware-overview-sality ~~www.symantec.com~~		\|Link=http://www.symantec.com/connect/blogs/all-one-malware-overview-sality
	\|Author=Nicolas Falliere,		\|Author=Nicolas Falliere,
	\|NomRevue=Symantec Connect Community		\|NomRevue=Symantec Connect Community

Eric.freyssinet: 1 revision imported

2015-02-07T14:23:21Z

1 revision imported

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://www.symantec.com/connect/blogs/all-one-malware-overview-sality www.symantec.com
|Author=Nicolas Falliere,
|NomRevue=Symantec Connect Community
|Date=07 May 2010
|Editor=Symantec
|Year=2010
|ISBN=
|Page=
|Abstract=W32.Sality is a family of file infectors that’s been around for a long time. It seems the virus first appeared back in 2003, originating in Russia. At that time, Sality was a file infector that prepended its viral code to a host, and had back door and keylogging facilities.

Nowadays, Sality’s “signature” remains the same—virus and Trojan capabilities—but it includes more features to facilitate propagation, assure its survival, and performs the dirty jobs. Among these capabilities is the decentralized peer-to-peer network (P2P) that Sality-infected computers create and populate, which I’ll introduce later on.

Sality is an entry-point obscuring file infector. Infected files will have their original, initial instructions overwritten with complex code, with an end-goal of reaching the viral body code and executing it. This body code is located in the last section and is encrypted. Once decrypted and executed, a separate thread is created to carry the virus payload memory mapping and execution. This payload is Sality itself. Let’s review its features.

The payload runs five distinct components in separate threads. The first component is a process injector. All processes—except those belonging to the users “local service”, “network service”, or “system”—will be injected with a copy of Sality to make sure the malware stays running.

The second component is responsible for lowering or disabling the general security of the system. Security-related processes and services are stopped, including many antivirus and personal firewall products. The registry is modified and SafeBoot key entries are deleted. Components such as registry editing with the Windows regedit.exe tool or Task Manager creation are disabled. Firewall rules are added to let Sality access the network and the Security Center, among other things, is disabled.
|Botnet=Sality,
|Malware=Sality_(bot),
|CCProtocol=p2p,
|Operation=,
|Keyword=,
}}

All-in-one malware: an overview of Sality - Revision history

Eric.freyssinet: Text replacement - "p2p" to "P2P"

Eric.freyssinet: Text replacement - " www.symantec.com" to ""

Eric.freyssinet: 1 revision imported