ThreatExpert Report: W32.Sality!dr, W32/Sality.gen.z, Troj/SalLoad-C, Virus.Win32.Sality..

Visit ThreatExpert web site

Close Report

Submission Summary:

Submission details:

Submission received: 16 June 2012, 08:04:14
Processing time: 13 min 15 sec
Submitted sample:

File MD5: 0xDD2E8194104F9EAF9DF6F813D5658FB7
File SHA-1: 0x7C7F09206C99A09F32F94B8481DE19F2B2A8E31E
Filesize: 103,140 bytes
Alias:

W32.Sality!dr [Symantec]
W32/Sality.gen.z [McAfee]
Troj/SalLoad-C [Sophos]
Virus.Win32.Sality [Ikarus]

Technical Details:

File System Modifications

The following files were created in the system:

#	Filename(s)	File Size	File Hash	Alias
1	c:\autorun.inf	320 bytes	MD5: 0xCCDE2D9C2E98D4E2FF483ED32FED7F94 SHA-1: 0x31BA65200903121710932A9013B2083C9E39FB34	Generic!atr [McAfee] Mal/AutoInf-A [Sophos]
2	c:\rafvrm.pif	103,140 bytes	MD5: 0x8F4FF65327A1B3776C72DC8DA8CEC61B SHA-1: 0x359BC14015176186E249407DA9536B5957732918	W32.Sality!dr [Symantec] W32/Sality.gen.z [McAfee] Troj/SalLoad-C [Sophos] Virus.Win32.Sality [Ikarus]
3	[file and pathname of the sample #1]	103,140 bytes	MD5: 0xDD2E8194104F9EAF9DF6F813D5658FB7 SHA-1: 0x7C7F09206C99A09F32F94B8481DE19F2B2A8E31E	W32.Sality!dr [Symantec] W32/Sality.gen.z [McAfee] Troj/SalLoad-C [Sophos] Virus.Win32.Sality [Ikarus]

The following files were modified:

%Windir%\system.ini
%System%\cmd.exe
%System%\mmc.exe
%System%\taskmgr.exe

Notes:

%Windir% is a variable that refers to the Windows installation folder. By default, this is C:\Windows or C:\Winnt.
%System% is a variable that refers to the System folder. By default, this is C:\Windows\System (Windows 95/98/Me), C:\Winnt\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Memory Modifications

There was a new process created in the system:

Process Name	Process Filename	Main Module Size
[filename of the sample #1]	[file and pathname of the sample #1]	86,016 bytes

Registry Modifications

The following Registry Keys were created:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system
HKEY_CURRENT_USER\Software\Apcrmkeh
HKEY_CURRENT_USER\Software\Apcrmkeh\-72398023

The newly created Registry Values are:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

UacDisableNotify = 0x00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

AntiVirusOverride = 0x00000001
AntiVirusDisableNotify = 0x00000001
FirewallDisableNotify = 0x00000001
FirewallOverride = 0x00000001
UpdatesDisableNotify = 0x00000001
UacDisableNotify = 0x00000001

to disable notification of firewall, antivirus and/or update status through the Windows Security Center

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]

EnableLUA = 0x00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\system]

DisableTaskMgr = 0x00000001
DisableRegistryTools = 0x00000001

to prevent users from starting Task Manager (Taskmgr.exe)

to disable the Windows registry editors (Regedt32.exe and Regedit.exe)

[HKEY_CURRENT_USER\Software\Apcrmkeh\-72398023]

1919251285 = 0x00000079
-456464726 = 0x00000000
1462786559 = 0x00000000
-912929452 = 0x00000023
1006321833 = 0x00000183
-1369394178 = "0A00687474703A2F2F63696B6D61796564656B70617263612E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6272756365676172726F642E636F6D2F696D616765732F6C6F676F732E67696600687474703A2F2F6362626173696D6576692E636F6D2F696D616765732F6C6F676F732E6769660
549857107 = "8D047AF7229C9B8962BA0482D99D368E2F27DA435BE2A7386A33EDC80BF5E291731E9D01A5491DAF960D9F12BEF04EC6593B061C5B93136EC6BFEC34C08A20B0C1FA17DCC2BD245ECA59601A83B2A1E4EA6D8C1E0D407E7C34901CE485312CA99533EF94DBD09BAC13BC887C7B5FA8BD183F0B60FDAC439D9A828FBE9

[HKEY_CURRENT_USER\Software\Apcrmkeh]

U1_0 = 0xC4A71155
U2_0 = 0x00002668
U3_0 = 0x01036A29
U4_0 = 0x00000000
U1_1 = 0xBBE88B0D
U2_1 = 0x726564D7
U3_1 = 0x7366197C
U4_1 = 0x72657355
U1_2 = 0x3955FE63
U2_2 = 0xE4CAC724
U3_2 = 0xE5C98C83
U4_2 = 0xE4CAE6AA
U1_3 = 0xCA4930AA
U2_3 = 0x57307C35
U3_3 = 0x563333D6
U4_3 = 0x573059FF
U1_4 = 0xCCD57805
U2_4 = 0xC995DAD1
U3_4 = 0xC896A77D
U4_4 = 0xC995CD54
U1_5 = 0x1D664B04
U2_5 = 0x3BFB515E
U3_5 = 0x3AF82A80
U4_5 = 0x3BFB40A9
U1_6 = 0xB7E969B6
U2_6 = 0xAE60AC1C
U3_6 = 0xAF63D9D7
U4_6 = 0xAE60B3FE
U1_7 = 0xAD13C10A
U2_7 = 0x20C63A4E
U3_7 = 0x21C54D7A
U4_7 = 0x20C62753
U1_8 = 0x82C2E2F1
U2_8 = 0x932B868C
U3_8 = 0x9228F081
U4_8 = 0x932B9AA8
U1_9 = 0xA9F73BAD
U2_9 = 0x05912B2A
U3_9 = 0x049267D4
U4_9 = 0x05910DFD
U1_10 = 0x4C6DEB81
U2_10 = 0x77F69FF1
U3_10 = 0x76F5EB7B
U4_10 = 0x77F68152
U1_11 = 0x64DD8D7B
U2_11 = 0xEA5BEB50
U3_11 = 0xEB589E8E
U4_11 = 0xEA5BF4A7
U1_12 = 0x1FE22AB1
U2_12 = 0x5CC17E6D
U3_12 = 0x5DC20DD5
U4_12 = 0x5CC167FC
U1_13 = 0x38566E00
U2_13 = 0xCF26FADF
U3_13 = 0xCE25B178
U4_13 = 0xCF26DB51
U1_14 = 0xBCECACE1
U2_14 = 0x418C54F4
U3_14 = 0x408F248F
U4_14 = 0x418C4EA6
U1_15 = 0xBB26A9B7
U2_15 = 0xB3F1DA94
U3_15 = 0xB2F2ABD2
U4_15 = 0xB3F1C1FB
U1_16 = 0x773E551E
U2_16 = 0x26572326
U3_16 = 0x27545F79
U4_16 = 0x26573550
U1_17 = 0x7F21E224
U2_17 = 0x98BCB4C0
U3_17 = 0x99BFC28C
U4_17 = 0x98BCA8A5
U1_18 = 0x5AF362AD
U2_18 = 0x0B220D15
U3_18 = 0x0A2171D3
U4_18 = 0x0B221BFA
U1_19 = 0xC06DA116
U2_19 = 0x7D87986A
U3_19 = 0x7C84E566
U4_19 = 0x7D878F4F
U1_20 = 0xD9F8589A
U2_20 = 0xEFED1FBB
U3_20 = 0xEEEE688D

The following Registry Value was modified:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

AntiVirusOverride =
FirewallOverride =

Other details

To mark the presence in the system, the following Mutex objects were created:

uxJLpe1m
Ap1mutx7

The following port was open in the system:

Port	Protocol	Process
6822	UDP	[file and pathname of the sample #1]

All content ("Information") contained in this report is the copyrighted work of Threat Expert Ltd and its associated companies ("ThreatExpert") and may not be copied without the express permission of ThreatExpert.

The Information is provided on an "as is" basis. ThreatExpert disclaims all warranties, whether express or implied, to the maximum extent permitted by law, including the implied warranties that the Information is merchantable, of satisfactory quality, accurate, fit for a particular purpose or need, or non-infringing, unless such implied warranties are legally incapable of exclusion. Further, ThreatExpert does not warrant or make any representations regarding the use or the results of the use of the Information in terms of their correctness, accuracy, reliability, or otherwise.