https://www.botnets.fr/index.php?action=history&feed=atom&title=The_Sality_botnet 2026-10-24T09:30:43Z Revision history for this page on the wiki MediaWiki 1.43.11 https://www.botnets.fr/index.php?title=The_Sality_botnet&diff=5713&oldid=prev 2015-08-05T19:46:24Z

<p>Text replacement - &quot; www.symantec.com&quot; to &quot;&quot;</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 19:46, 5 August 2015</td> </tr><tr><td colspan="2" class="diff-lineno" id="mw-diff-left-l1">Line 1:</td> <td colspan="2" class="diff-lineno">Line 1:</td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>{{Publication</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>{{Publication</div></td></tr> <tr><td class="diff-marker" data-marker="−"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #ffe49c; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://www.symantec.com/connect/blogs/sality-botnet <del style="font-weight: bold; text-decoration: none;">www.symantec.com</del></div></td><td class="diff-marker" data-marker="+"></td><td style="color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #a3d3ff; vertical-align: top; white-space: pre-wrap;"><div>|Link=http://www.symantec.com/connect/blogs/sality-botnet</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Nicolas Falliere</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|Author=Nicolas Falliere</div></td></tr> <tr><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Symantec Connect Community</div></td><td class="diff-marker"></td><td style="background-color: #f8f9fa; color: #202122; font-size: 88%; border-style: solid; border-width: 1px 1px 1px 4px; border-radius: 0.33em; border-color: #eaecf0; vertical-align: top; white-space: pre-wrap;"><div>|NomRevue=Symantec Connect Community</div></td></tr> <!-- diff cache key wiki:diff:1.41:old-1993:rev-5713:php=table --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=The_Sality_botnet&diff=1993&oldid=prev 2015-02-07T14:23:20Z

<p>1 revision imported</p> <table style="background-color: #fff; color: #202122;" data-mw="interface"> <col class="diff-marker" /> <col class="diff-content" /> <col class="diff-marker" /> <col class="diff-content" /> <tr class="diff-title" lang="en"> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">← Older revision</td> <td colspan="2" style="background-color: #fff; color: #202122; text-align: center;">Revision as of 14:23, 7 February 2015</td> </tr><tr><td colspan="4" class="diff-notice" lang="en"><div class="mw-diff-empty">(No difference)</div> </td></tr> <!-- diff cache key wiki:diff:1.41:old-1992:rev-1993 --> </table>

Eric.freyssinet https://www.botnets.fr/index.php?title=The_Sality_botnet&diff=1992&oldid=prev 2012-11-25T00:23:22Z

<p></p> <p><b>New page</b></p><div>{{Publication<br /> |Link=http://www.symantec.com/connect/blogs/sality-botnet www.symantec.com<br /> |Author=Nicolas Falliere<br /> |NomRevue=Symantec Connect Community<br /> |Date=14 May 2010<br /> |Editor=Symantec<br /> |Year=2010<br /> |Botnet=Maazben, Storm, Pandex, Rustock<br /> |Malware=Sality<br /> |CCProtocol=P2P<br /> |Abstract=As discussed in a [[All-in-one_malware:_an_overview_of_Sality|previous blog entry]], Sality-infected computers become part of a peer-to-peer (P2P) botnet. This botnet is used by peers to exchange lists of URLs pointing to malicious software, which Sality will decrypt, download and install.<br /> <br /> Though the peer-to-peer protocol used by Sality is custom, we can reverse-engineer the malware binary to determine the P2P packet format, as well as protocol rules and features. Traffic analysis can be used to facilitate or guide a white box approach. Eventually, writing a working P2P client and/or server can be used to validate the analysis.<br /> <br /> I decided to create a rogue P2P client that would join the Sality botnet and crawl it, in order to estimate its size.<br /> <br /> Let’s do a quick reminder of what the P2P protocol offers:<br /> <br /> A peer can ask another peer for its list of URLs.<br /> A peer can send its list of URLs to another peer.<br /> A peer can ask another peer to send the coordinates (IP, port) of a third-party peer.<br /> }}</div>

Eric.freyssinet