Virus:Win32/Sality.M (file analysis)

The Virus:Win32/Sality.M is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.

DOWNLOAD NOW

6-day free trial available.

What Virus:Win32/Sality.M virus can do?

• Unconventionial language used in binary resources: Czech
• The binary contains an unknown PE section name indicative of packing
• Executable file is packed/obfuscated with ASPack
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Binary file triggered YARA rule
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Sality.M?

File Info:
name: 3DAE57BA552E5BA5AE7A.mlw
path: /opt/CAPEv2/storage/binaries/bb9357d613bec746a6176640dfd2582bcdffcd374771f4921a2fee91a65ccf57
crc32: B2A7F7AC
md5: 3dae57ba552e5ba5ae7a769f4ef64c65
sha1: cb8ee59b86fe9873199205f624ac0424ebc3af53
sha256: bb9357d613bec746a6176640dfd2582bcdffcd374771f4921a2fee91a65ccf57
sha512: 2ccf836058a822bd088e1301e171a6c6327eea92049d78ef1c45c5d2bd3171ee60e94f0f69aee6159b21572ca41204915c0e7bf4641735b953332a64035218ea
ssdeep: 12288:V5EXfVQtEHAFlPiJxbeL/eeDvU0+t9d3ZozbcmoUu9gunnieO:TEXfVJckeqWvwJqEmoUuiVp
type: PE32 executable (GUI) Intel 80386, for MS Windows
tlsh: T17EA4228A63B84981CCF585F017CB3BCE8326F88FB0640B6B04B3595D5AFB550DD62B96
sha3_384: cf1577d089f7d1a8f188a5d79d107a64cdc9b6eedba1725381647103bb72b07165f0b248f5d756a49e867efe8af07bef
ep_bytes: 60e8540000008dbd00104000b8ff4f00
timestamp: 1992-06-19 22:22:17

Version Info:
CompanyName: miroslav@flesko.cz
FileDescription: Radio tuner. Download on http://flesko.cz
FileVersion: 1.8.0.2
InternalName: radiator
LegalCopyright: © 1999 - 2001 Miroslav Flesko
LegalTrademarks: None
OriginalFilename: radiator.exe
ProductName: Radiator
ProductVersion: Tested on Windows 2000 and Windows 98.
Comments: Any comments send to miroslav@flesko.cz. Made in the Czech Republic.
WWW: http://flesko.cz
CardsList#1: Receiver for RadioTrack, RadioTrack II, Reveal RA300, SoundForte SF16 - FMP2, SoundForte SF16 - FMI, Aztech / Packard Bell, Comp - Express, GemTek, SF16 - FMR2, SF16 - FMD2 ...
CardsList#2: ... GemTek RadioMan, GemTek Wizard Radio, Justy Radion-maru, Unit Rajikoma, Zoltrix RadioPlus 108, AverMedia TV98, GemTek FMRadio 21 (USB), SoundForte SF256-PCx Xtreme, SoundForte SF16-FMX and SoundForte SF16-FMR radio cards.
Translation: 0x0409 0x04e4

Virus:Win32/Sality.M also known as:

How to remove Virus:Win32/Sality.M?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.