Threat Description

P2P-Worm:W32/Bacteraloh.H

Details

Aliases:P2P-Worm:W32/Bacteraloh.H, P2P-Worm.Win32.Bacteraloh.h, PE_SALITY.AL (Trend Micro) , W32/Sality.ac (McAfee), W32.Sality.X (Symantec)
Category:Malware
Type:P2P-Worm
Platform:W32

Summary



The detection P2P-Worm.Win32.Bacteraloh.H refers to files that have been infected by Virus.Win32.Sality.S.



Removal


Automatic action

Once detected, the F-Secure security product will automatically disinfect the suspect file by either deleting it or renaming it.

More

You may wish to refer to the Support Community for further assistance. You also may also refer to General Removal Instructions for a general guide on alternative disinfection actions.



Technical Details



While active, Sality.S terminates running processes with names associated with common antivirus programs.

Infection

Sality.S is an appending, polymorphic file infector that uses an entry point obscuring technique. During infection, it replaces 129 bytes from the beginning of the host file's code with its decryption routine, then hides the replaced code in its own code. The virus's own code is encrypted and appended to the host file as a new section, with a random name and a size of 28672 bytes.A detailed description of Sality's method of operation is available in the description of Virus.Win32.Sality.Q.

Installation

During installation, Sality.S creates the following files:

  • %windir%\system32\wmdrtc32.dl_ - Archived copy of wmdrtc32.dll
  • %windir%\system32\wmdrtc32.dll - Detected as Virus.Win32.Sality.S
  • %windir%\system32\drivers\ekkkjn.sys - Detected as Virus.Win32.Sality.S

It modifies the file %windir%\system.ini by adding the following:

  • [MCIDRV_VER] DEVICE=

In addition, the following is loaded into all processes

  • %windir%\system32\wmdrtc32.dll

Registry

Sality.S deletes a large number of registry keys, a small sample of which is listed in this description.

Process Changes

Creates these mutexes:

  • _kuku_joker_v4.00

Network Connections

Attempts to connect with HTTP to:

  • http://www.bpfq02 .com
  • http://www.inform1ongung .info
  • http://www.g1ikddcvns3sdsal .info
  • http://www.f5ds1jkkk4d .info
  • http://www.lukki6dnd2kdnc .info
  • http://www.h7smcnr1wlsdn34fgv .info
  • http://wnt: KUKUww.hkukud123ncs .info
  • http://www.kukutrustnet .info
  • http://www.kukutrustnet7 .info
  • http://www.kukutrustnet666 .info/[...]_nrl

Registry Modifications

Sets these values:

  • HKLM\System\CurrentControlSet\Services\NdisFileServices32 Type = 00000001
  • HKLM\System\CurrentControlSet\Services\NdisFileServices32 Start = 00000002
  • HKLM\System\CurrentControlSet\Services\NdisFileServices32 ErrorControl = 00000001
  • HKLM\System\CurrentControlSet\Services\NdisFileServices32 ImagePath = \??\C:\WINDOWS\system32\drivers\ekkkjn.sys
  • [Launchpoint: Service]
  • HKLM\System\CurrentControlSet\Services\NdisFileServices32 DisplayName = NdisFileServices32
  • HKLM\System\CurrentControlSet\Services\NdisFileServices32\Security Security = \x01\x00\x14\x80\x90\x00\x00\x00\x9C\x00\x00\x00\x14\x00\x00\x00\x30\x00\x00\x00\x02\x00\x1C\x00\x01\x00\x00\x00\x02\x80\x14\x00\xFF\x01\x0F\x00\x01\x01\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x02\x00\x60\x00\x04\x00\x00\x00\x00\x00\x14\x00\xFD\x01\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x00\x00\x18\x00\xFF\x01\x0F\x00\x01\x02\x00\x00\x00\x00\x00\x05\x20\x00\x00\x00\x20\x02\x00\x00\x00\x00\x14\x00\x8D\x01\x02\x00\x01\x01\x00\x00\x00\x00\x00\x05\x0B\x00\x00\x00\x00\x00\x18\x00\xFD\x01\x02\x00\x01\x02\x00\x00\x00\x00\x00\x05\x20\x00\x00\x00\x23\x02\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00\x01\x01\x00\x00\x00\x00\x00\x05\x12\x00\x00\x00
  • HKLM\System\CurrentControlSet\Services\ALG DeleteFlag = 00000001
  • HKLM\System\CurrentControlSet\Services\ALG Start = 00000004
  • HKLM\System\CurrentControlSet\Services\bdss DeleteFlag = 00000001
  • HKLM\System\CurrentControlSet\Services\bdss Start = 00000004
  • HKLM\System\CurrentControlSet\Services\F-Secure Gatekeeper Handler Starter DeleteFlag = 00000001
  • HKLM\System\CurrentControlSet\Services\F-Secure Gatekeeper Handler Starter Start = 00000004
  • HKLM\System\CurrentControlSet\Services\navapsvc DeleteFlag = 00000001
  • HKLM\System\CurrentControlSet\Services\navapsvc Start = 00000004
  • HKLM\System\CurrentControlSet\Services\AVP DeleteFlag = 00000001
  • HKLM\System\CurrentControlSet\Services\AVP Start = 00000004
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings GlobalUserOffline = 00000000
  • HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce shell = Explorer.exe [Launchpoint: RunOnce]

Deletes these values:

  • HKLM\System\CurrentControlSet\Control\SafeBoot\AlternateShell
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Base\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\dmserver\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\EventLog\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\File system\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Filter\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys\ [Launchpoint: Safe mode (minimal)]
  • HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\sr.sys\ [Launchpoint: Safe mode (minimal)]





SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More