TrojanDropper:Win32/Sality.AU (file analysis)

The TrojanDropper:Win32/Sality.AU is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What TrojanDropper:Win32/Sality.AU virus can do?

• Behavioural detection: Executable code extraction – unpacking
• CAPE extracted potentially suspicious content
• Drops a binary and executes it
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Behavioural detection: Injection (inter-process)
• Behavioural detection: Injection with CreateRemoteThread in a remote process
• CAPE detected the embedded win api malware family
• Operates on local firewall’s policies and settings
• Attempts to disable UAC
• Attempts to modify or disable Security Center warnings
• Attempts to block SafeBoot use by removing registry keys
• Attempts to modify Explorer settings to prevent hidden files from being displayed
• Yara detections observed in process dumps, payloads or dropped files

How to determine TrojanDropper:Win32/Sality.AU?

File Info:
name: D8CE2E83722FA315F916.mlw
path: /opt/CAPEv2/storage/binaries/dffd0805ee4a340ff2115d6b4d3a838ab338e63529c98a8026eeb16357516923
crc32: DCE6BE3A
md5: d8ce2e83722fa315f916f728fe156ee2
sha1: 0d1e1a22015bc78d3fdf7d38c79e548d53dd30f8
sha256: dffd0805ee4a340ff2115d6b4d3a838ab338e63529c98a8026eeb16357516923
sha512: 68fb5c9782c099e6f8b5d565e2d82b1c62b20deac6201872c3a09440f1ca07146f1b4e753712d46ac8a1267761950b0c6695ebd1df8e119dd3513875af2e17f3
ssdeep: 1536:jEkzWwPeRN30DSeGXX6VRdIesE1dNYCXpgjU7A71Zbhhbh5sc3e:jEkzWw2R2oKVRdIezdeC5fAvbhac3
type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
tlsh: T10BC312EBE56F3A55DE82B33D780BBD90FBA274201757029171AECE9650B53C3C125E21
sha3_384: ddaba948d755edfee2cea1ce5bb63883a18f79eadf3bcb635c255c6c8d73d96bc0f644c8e6124f41b3d89e3e5ce5b8be
ep_bytes: 558bec6a02ff1524100010e81efdffff
timestamp: 2010-11-05 20:30:50

Version Info:
0: [No Data]

TrojanDropper:Win32/Sality.AU also known as:

How to remove TrojanDropper:Win32/Sality.AU?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.