Sality

Key takeaways

Sality belongs to computer science; place it in that map before memorising details.
Learn the definition first, then one example that makes the definition concrete.
Connect Sality to a quantity you can measure, compute or draw — that is where exam questions come from.
Reproduce the core statement of Sality from memory before moving on to harder problems.

Reference excerpt

Sality is the classification for a family of malicious software (malware) infecting Microsoft Windows system files. Sality was first discovered in 2003 and has advanced into a dynamic, enduring, full-featured form of malicious code. Systems infected with Sality may communicate over a peer-to-peer (P2P) network to form a botnet to relay spam, proxy communications, exfiltrate sensitive data, compromise web servers, and/or coordinate distributed computing tasks to process intensive tasks (e.g., password cracking). Since 2010, certain variants of Sality have also incorporated rootkit functions as part of an ongoing evolution of the malware family. Because of its continued development and capabilities, Sality is considered one of the most complex and formidable forms of malware to date.

Aliases The majority of Antivirus (A/V) vendors use the following naming conventions when referring to this family of malware:

Sality SalLoad Kookoo SaliCode Kukacka

Overview Sality is a family of polymorphic file infectors, which target Windows executable files with the extensions .EXE or .SCR. Sality utilizes polymorphic and entry-point obscuring (EPO) techniques to infect files using the following methods: not changing the entry point address of the host, and replacing the original host code at the entry point of the executable with a variable stub to redirect execution to the polymorphic viral code, which has been inserted in the last section of the host file; the stub decrypts and executes a secondary region, known as the loader; finally, the loader runs in a separate thread within the infected process to eventually load the Sality payload. Sality may execute a malicious payload that deletes files with certain extensions and/or beginning with specific strings, terminates security-related processes and services, searches a user's address book for e-mail addresses to send spam messages, and contacts a remote host. Sality may also download additional executable files to install other malware, and for the purpose of propagating pay per install applications. Sality may contain Trojan components; some variants may have the ability to steal sensitive personal or financial data (i.e., information stealers), generate and relay spam, relay traffic via HTTP proxies, infect websites, and achieve distributed computing tasks such as password cracking, as well as other capabilities. Sality's downloader mechanism downloads and executes additional malware as listed in the URLs received using the peer-to-peer component. The distributed malware may share the same “code signature” as the Sality payload, which may provide attribution to one group and/or indicate that they share a large portion of the code. The additional malware typically communicates with and reports to central command and control (C&C) servers located throughout the world. According to Symantec, the "combination of file infection mechanism and the fully decentralized peer-to-peer network [...] makes Sality one of the most effective and resilient malware in today's threat landscape." Two versions of the botnet are currently active: versions 3 and 4. The malware circulated on those botnets is digitally signed by the attackers to prevent a hostile takeover. In recent years, Sality has also included the use of rootkit techniques to maintain persistence on compromised systems and evade host-based detections, such as anti-virus software. The top countries affected by the botnet were India, Vietnam, and Morocco.

Installation Sality infects files in the affected computer. Most variants use a DLL that is dropped once on each computer. The DLL file is written to disk in two forms, for example:

%SYSTEM%\wmdrtc32.dll %SYSTEM%\wmdrtc32.dl_ The DLL file contains the bulk of the virus code. The file with the extension ".dl_" is the compressed copy. Recent variants of Sality, such as Virus:Win32-Sality.AM, do not drop the DLL; instead, load it entirely in memory without writing it to disk. This variant, along with others, also drop a driver with a random file name in the folder %SYSTEM%\drivers. Other malware may also drop Sality in the computer. For example, a Sality variant detected as Virus:Win32-Sality.AU is dropped by Worm:Win32-Sality.AU. Some Sality variants may also include a rootkit by creating a device named Device\amsint32 or \DosDevices\amsint32.

Method of propagation

File infection Sality usually targets all files in drive C: that have .SCR or .EXE file extensions, beginning with the root folder. Infected files increase in size by a varying amount. The virus also targets applications that run at each Windows start and frequently used applications, referenced by the following registry keys:

HKCU\Software\Microsoft\Windows\ShellNoRoam\MUICache HKCU\Software\Microsoft\Windows\CurrentVersion\Run HKLM\Software\Microsoft\Windows\CurrentVersion\Run Sality avoids infecting particular files in order to remain hidden in the computer:

Files protected by System File Checker (SFC) Files under the %SystemRoot% folder Executables of several antivirus/firewall products ignore files that contain certain substrings

Removable drives and network shares Some Sality variants can infect legitimate files, which are then moved to available removable drives and network shares by enumerating all network share folders and resources of the local computer and all files in drive C: (beginning with the root folder). It infects the files it finds by adding a new code section to the host and inserting its malicious code into the newly added section. If a legitimate file exists, the malware will copy the file to the Temporary Files folder and then infect the file. The resulting infected file is then moved to the root of all available removable drives and network shares as any of the following:

random file name.pif random file name.exe random file name.cmd The Sality variant also creates an "autorun.inf" file in the root of all these drives that points to the virus copy. When a drive is accessed from a computer supporting the AutoRun feature, the virus is then launched automatically. Some Sality variants may also drop a file with a .tmp file extension to the discovered network shares and resources as well as drop a .LNK file to run the dropped virus.

Payload

… excerpt ends here. Continue reading the full article.

Worked examples

Example 1 — a first encounter with Sality

Start with the simplest possible case. Write down what Sality claims or describes in one sentence, then invent the smallest concrete situation in which that sentence is true. In computer science, the smallest case is usually a single object, a single equation or a single measurement. Check that every symbol or term in your sentence has a meaning in that case.

Example 2 — changing one variable

Take the situation from Example 1 and change exactly one quantity: double it, halve it, or set it to zero. Predict what should happen to Sality before you calculate. Comparing your prediction with the result is the fastest way to find out whether you understand the idea or only the words.

Example 3 — an exam-style question

Typical questions about Sality ask you to (a) state it precisely, (b) apply it to given data, and (c) explain a limitation. Practise writing all three answers in under five minutes; the third part is what separates a full-mark answer from an average one.

Applications of Sality

In research: Sality appears in computer science research whenever the underlying quantities have to be modelled precisely. Papers usually cite it as a starting assumption and then explore where it breaks down.
In technology and industry: Engineering practice reuses Sality in design rules, simulations and safety margins. Knowing the idea lets you read a specification sheet and understand why the numbers look the way they do.
In the classroom: Sality is common in secondary-school and first-year university syllabi. It links to neighbouring topics Botnets, Cybercrime in India, Distributed computing projects, so understanding it makes those chapters shorter.
In everyday life: Look for Sality outside the textbook — in sport, cooking, traffic, electronics or the sky above you. An example you found yourself is remembered far longer than one you were given.

How to study Sality in 20 minutes

Read the reference excerpt below once, without taking notes.
Close the page and write down what Sality means in your own words.
Compare your version with the excerpt and mark what you missed.
Work through the three examples above with pen and paper.
Explain Sality out loud to somebody else — or to Teacher Smith in the lgStudy chat.

Frequently asked questions

What is Sality in simple terms?

Sality is the classification for a family of malicious software (malware) infecting Microsoft Windows system files. Sality was first discovered in 2003 and has advanced into a dynamic, enduring, full-featured form of malicious code.

Why does Sality matter?

Because it connects several computer science ideas at once: it gives you a definition you can apply, a quantity you can calculate, and a way to check whether a result is plausible.

How should I study Sality?

Read the excerpt, restate it from memory, then work through the examples and applications listed on this page. The five-step study plan above takes about twenty minutes.

What does this page cover?

It gives you a compact reference excerpt plus original lgStudy explanations, examples, applications and study material on Sality.