Virus:Win32/Sality.M (file analysis)

The Virus:Win32/Sality.M is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

What Virus:Win32/Sality.M virus can do?

• Unconventionial language used in binary resources: Czech
• The binary contains an unknown PE section name indicative of packing
• Executable file is packed/obfuscated with ASPack
• The binary likely contains encrypted or compressed data.
• Authenticode signature is invalid
• Binary file triggered YARA rule
• Anomalous binary characteristics
• Yara detections observed in process dumps, payloads or dropped files

How to determine Virus:Win32/Sality.M?

File Info:
name: 3DAE57BA552E5BA5AE7A.mlwpath: /opt/CAPEv2/storage/binaries/bb9357d613bec746a6176640dfd2582bcdffcd374771f4921a2fee91a65ccf57crc32: B2A7F7ACmd5: 3dae57ba552e5ba5ae7a769f4ef64c65sha1: cb8ee59b86fe9873199205f624ac0424ebc3af53sha256: bb9357d613bec746a6176640dfd2582bcdffcd374771f4921a2fee91a65ccf57sha512: 2ccf836058a822bd088e1301e171a6c6327eea92049d78ef1c45c5d2bd3171ee60e94f0f69aee6159b21572ca41204915c0e7bf4641735b953332a64035218eassdeep: 12288:V5EXfVQtEHAFlPiJxbeL/eeDvU0+t9d3ZozbcmoUu9gunnieO:TEXfVJckeqWvwJqEmoUuiVptype: PE32 executable (GUI) Intel 80386, for MS Windowstlsh: T17EA4228A63B84981CCF585F017CB3BCE8326F88FB0640B6B04B3595D5AFB550DD62B96sha3_384: cf1577d089f7d1a8f188a5d79d107a64cdc9b6eedba1725381647103bb72b07165f0b248f5d756a49e867efe8af07befep_bytes: 60e8540000008dbd00104000b8ff4f00timestamp: 1992-06-19 22:22:17
Version Info:
CompanyName: miroslav@flesko.czFileDescription: Radio tuner. Download on http://flesko.czFileVersion: 1.8.0.2InternalName: radiatorLegalCopyright: © 1999 - 2001 Miroslav FleskoLegalTrademarks: NoneOriginalFilename: radiator.exeProductName: RadiatorProductVersion: Tested on Windows 2000 and Windows 98.Comments: Any comments send to miroslav@flesko.cz. Made in the Czech Republic.WWW: http://flesko.czCardsList#1: Receiver for RadioTrack, RadioTrack II, Reveal RA300, SoundForte SF16 - FMP2, SoundForte SF16 - FMI, Aztech / Packard Bell, Comp - Express, GemTek, SF16 - FMR2, SF16 - FMD2 ...CardsList#2: ... GemTek RadioMan, GemTek Wizard Radio, Justy Radion-maru, Unit Rajikoma, Zoltrix RadioPlus 108, AverMedia TV98, GemTek FMRadio 21 (USB), SoundForte SF256-PCx Xtreme, SoundForte SF16-FMX and SoundForte SF16-FMR radio cards.Translation: 0x0409 0x04e4

Virus:Win32/Sality.M also known as:

How to remove Virus:Win32/Sality.M?

• Download and install GridinSoft Anti-Malware.
• Open GridinSoft Anti-Malware and perform a “Standard scan“.
• “Move to quarantine” all items.
• Open “Tools” tab – Press “Reset Browser Settings“.
• Select proper browser and options – Click “Reset”.
• Restart your computer.