Virus.Win32.Sality_598804a3aa – Adaware

Virus.Win32.Sality.gen (Kaspersky), Win32.Sality.3 (B) (Emsisoft), Win32.Sality.3 (AdAware), Trojan.Win32.Bumat.FD, Virus.Win32.Sality.FD, Virus.Win32.Sality.2.FD, VirusSality.YR, GenericAutorunWorm.YR, GenericInjector.YR, GenericIRCBot.YR (Lavasoft MAS)Behaviour: Trojan, Worm, Virus, WormAutorun, IRCBot

The description has been automatically generated by Lavasoft Malware Analysis System and it may contain incomplete or inaccurate information.

Summary

MD5: 598804a3aad6bbbd0ec2946772f63e03

SHA1: c82760b0942e07631fbe41a68951fdc8b031ca5a

SHA256: b696adcd2f0f081b3702116d057a02c66d711080e76db5d5ffe75e132eecf8b3

SSDeep: 24576:i6rT7/pZLZzHA9PkpiowEusqiydSMY5AEbDe8:iC7RnYPkpMshyoZy8

Size: 886008 bytes

File type: EXE

Platform: WIN32

Entropy: Packed

PEID: UPolyXv05_v6

Company: no certificate found

Created at: 2007-05-05 08:40:22

Analyzed on: WindowsXP SP3 32-bit

Summary: Virus. A program that recursively replicates a possibly evolved copy of itself.

Dynamic Analysis

Payload

Behaviour	Description
WormAutorun	A worm can spread via removable drives. It writes its executable and creates "autorun.inf" scripts on all removable drives. The autorun script will execute the Virus's file once a user opens a drive's folder in Windows Explorer.
IRCBot	A bot can communicate with command and control servers via IRC channel.

Process activity

The Virus creates the following process(es):

attrib.exe:1160
wuauclt.exe:540
regedit.exe:1092
AgentSvr.exe:2088
%original file name%.exe:2012

The Virus injects its code into the following process(es):

spoolv.exe:1180
Explorer.EXE:1912

File activity

The process wuauclt.exe:540 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\edb.chk (100 bytes)
%WinDir%\SoftwareDistribution\DataStore\Logs\edb.log (2016 bytes)
%WinDir%\SoftwareDistribution\DataStore\DataStore.edb (100 bytes)

The Virus deletes the following file(s):

%WinDir%\SoftwareDistribution\DataStore\Logs\tmp.edb (0 bytes)

The process spoolv.exe:1180 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%WinDir%\spoolv\control.ini (80 bytes)
%WinDir%\spoolv\TMP3.$$$ (51 bytes)
%WinDir%\spoolv\TMP4.$$$ (60 bytes)
%WinDir%\spoolv\TMP1.$$$ (30 bytes)
%WinDir%\spoolv\remote.ini (8197 bytes)
%WinDir%\spoolv\TMP2.$$$ (46 bytes)
%WinDir%\spoolv\mirc.ini (112512 bytes)

The Virus deletes the following file(s):

%WinDir%\spoolv\TMP3.$$$ (0 bytes)
%WinDir%\spoolv\TMP4.$$$ (0 bytes)
%WinDir%\spoolv\TMP1.$$$ (0 bytes)
%WinDir%\spoolv\TMP6.$$$ (0 bytes)
%WinDir%\spoolv\TMP2.$$$ (0 bytes)
%WinDir%\spoolv\TMP5.$$$ (0 bytes)

The process %original file name%.exe:2012 makes changes in the file system.

The Virus creates and/or writes to the following file(s):

%WinDir%\spoolv\spoolv.exe (33452 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000455EC_Rar\%original file name%.exe (6841 bytes)
%WinDir%\spoolv\control.ini (42 bytes)
%WinDir%\spoolv\run.bat (135 bytes)
%WinDir%\spoolv\ccc.mrc (10 bytes)
%WinDir%\spoolv\idents.txt (135 bytes)
%WinDir%\spoolv\aliases.ini (72 bytes)
%WinDir%\spoolv\reg.reg (1 bytes)
%WinDir%\spoolv\servers.ini (605 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\00045531_Rar\%original file name%.exe (6841 bytes)
%WinDir%\spoolv\mirc.ico (5 bytes)
%WinDir%\spoolv\users.ini (178 bytes)
%WinDir%\spoolv\fullnames.txt (78 bytes)
%Documents and Settings%\%current user%\Local Settings\Temp\000453D9_Rar\%original file name%.exe (6841 bytes)
%WinDir%\spoolv\mirc.ini (3 bytes)

The Virus deletes the following file(s):

%WinDir%\spoolv\__tmp_rar_sfx_access_check_284140 (0 bytes)

Registry activity

The process attrib.exe:1160 makes changes in the system registry.