SYMBOLCOMMON_NAMEaka. SYNONYMS
win.sality (Back to overview)

Sality

Actor(s): Salty Spider

VTCollection    

F-Secure states that the Sality virus family has been circulating in the wild as early as 2003. Over the years, the malware has been developed and improved with the addition of new features, such as rootkit or backdoor functionality, and so on, keeping it an active and relevant threat despite the relative age of the malware.

Modern Sality variants also have the ability to communicate over a peer-to-peer (P2P) network, allowing an attacker to control a botnet of Sality-infected machines. The combined resources of the Sality botnet may also be used by its controller(s) to perform other malicious actions, such as attacking routers.

Infection
Sality viruses typically infect executable files on local, shared and removable drives. In earlier variants, the Sality virus simply added its own malicious code to the end of the infected (or host) file, a technique known as prepending. The viral code that Sality inserts is polymorphic, a form of complex code that is intended to make analysis more difficult.

Earlier Sality variants were regarded as technically sophisticated in that they use an Entry Point Obscuration (EPO) technique to hide their presence on the system. This technique means that the virus inserts a command somewhere in the middle of an infected file's code, so that when the system is reading the file to execute it and comes to the command, it forces the system to 'jump' to the malware's code and execute that instead. This technique was used to make discovery and disinfection of the malicious code harder.

Payload
Once installed on the computer system, Sality viruses usually also execute a malicious payload. The specific actions performed depend on the specific variant in question, but generally Sality viruses will attempt to terminate processes, particularly those related to security programs. The virus may also attempt to open connections to remote sites, download and run additional malicious files, and steal data from the infected machine.

References
2022-07-14 ⋅ Dragos ⋅ Sam Hanson
The Trojan Horse Malware & Password “Cracking” Ecosystem Targeting Industrial Operators
Sality
2022-04-20 ⋅ CISA ⋅ Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), CISA, FBI, Government Communications Security Bureau, National Crime Agency (NCA), NCSC UK, NSA
AA22-110A Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader
2022-04-20 ⋅ CISA ⋅ CISA
Alert (AA22-110A): Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader Killnet
2021-10-27 ⋅ Mandiant ⋅ Corey Hildebrandt, Daniel Kapellmann Zafra, Ken Proska, Nathan Brubaker
Portable Executable File Infecting Malware Is Increasingly Found in OT Networks
CCleaner Backdoor Floxif neshta Ramnit Sality Virut
2020-05-24 ⋅ Palo Alto Networks Unit 42 ⋅ Ajaya Neupane, Stefan Achleitner
Using AI to Detect Malicious C2 Traffic
Emotet Sality
2017-10-29 ⋅ quangnh89
Sality Configuration Extractor (sality_extractor.py)
Sality
2017-05-03 ⋅ IEEE ⋅ Alok Tongaonkar, Gaspar Modelo-Howard, Lorenzo De Carli, Ruben Torres, Somesh Jha
Botnet Protocol Inference in the Presence of Encrypted Traffic
Ramnit Sality ZeroAccess
2015-12-02 ⋅ Botconf ⋅ Peter Kleissner
Sality: 2003 - Today
Sality
2011-07-01 ⋅ Symantec ⋅ Nicolas Falliere
Sality: Story of a Peerto-Peer Viral Network
Sality
Yara Rules
[TLP:WHITE] win_sality_auto (20260917 | Detects win.sality.)
rule win_sality_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.sality."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sality"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 52 68ff011f00 8d45f4 50 }
            // n = 4, score = 400
            //   52                   | push                edx
            //   68ff011f00           | push                0x1f01ff
            //   8d45f4               | lea                 eax, [ebp - 0xc]
            //   50                   | push                eax

        $sequence_1 = { 0f8411010000 8b55dc 33c0 668b4212 }
            // n = 4, score = 400
            //   0f8411010000         | je                  0x117
            //   8b55dc               | mov                 edx, dword ptr [ebp - 0x24]
            //   33c0                 | xor                 eax, eax
            //   668b4212             | mov                 ax, word ptr [edx + 0x12]

        $sequence_2 = { 7207 b801040000 eb54 8b55fc 2b55f4 8b450c 8910 }
            // n = 7, score = 400
            //   7207                 | jb                  9
            //   b801040000           | mov                 eax, 0x401
            //   eb54                 | jmp                 0x56
            //   8b55fc               | mov                 edx, dword ptr [ebp - 4]
            //   2b55f4               | sub                 edx, dword ptr [ebp - 0xc]
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8910                 | mov                 dword ptr [eax], edx

        $sequence_3 = { 52 68a3000000 e8???????? 83c414 8b4dfc 03c8 894dfc }
            // n = 7, score = 400
            //   52                   | push                edx
            //   68a3000000           | push                0xa3
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   03c8                 | add                 ecx, eax
            //   894dfc               | mov                 dword ptr [ebp - 4], ecx

        $sequence_4 = { 721b 817d08d5000000 7712 8b4510 0345fc c6000f 8b4dfc }
            // n = 7, score = 400
            //   721b                 | jb                  0x1d
            //   817d08d5000000       | cmp                 dword ptr [ebp + 8], 0xd5
            //   7712                 | ja                  0x14
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   0345fc               | add                 eax, dword ptr [ebp - 4]
            //   c6000f               | mov                 byte ptr [eax], 0xf
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]

        $sequence_5 = { 0f8410010000 e8???????? 25ffff0000 99 b967000000 f7f9 }
            // n = 6, score = 400
            //   0f8410010000         | je                  0x116
            //   e8????????           |                     
            //   25ffff0000           | and                 eax, 0xffff
            //   99                   | cdq                 
            //   b967000000           | mov                 ecx, 0x67
            //   f7f9                 | idiv                ecx

        $sequence_6 = { 0f8410020000 c785ccfdffff28010000 b949000000 33c0 }
            // n = 4, score = 400
            //   0f8410020000         | je                  0x216
            //   c785ccfdffff28010000     | mov    dword ptr [ebp - 0x234], 0x128
            //   b949000000           | mov                 ecx, 0x49
            //   33c0                 | xor                 eax, eax

        $sequence_7 = { 833c8a00 7402 eb10 8b450c 8b4d0c 83e901 }
            // n = 6, score = 400
            //   833c8a00             | cmp                 dword ptr [edx + ecx*4], 0
            //   7402                 | je                  4
            //   eb10                 | jmp                 0x12
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   83e901               | sub                 ecx, 1

        $sequence_8 = { 64ff30 8d8586134000 8920 896804 8d9dba114000 895808 }
            // n = 6, score = 200
            //   64ff30               | push                dword ptr fs:[eax]
            //   8d8586134000         | lea                 eax, [ebp + 0x401386]
            //   8920                 | mov                 dword ptr [eax], esp
            //   896804               | mov                 dword ptr [eax + 4], ebp
            //   8d9dba114000         | lea                 ebx, [ebp + 0x4011ba]
            //   895808               | mov                 dword ptr [eax + 8], ebx

        $sequence_9 = { b996000000 32c0 f2ae 8bcf 2b4c2410 8b5678 0354240c }
            // n = 7, score = 200
            //   b996000000           | mov                 ecx, 0x96
            //   32c0                 | xor                 al, al
            //   f2ae                 | repne scasb         al, byte ptr es:[edi]
            //   8bcf                 | mov                 ecx, edi
            //   2b4c2410             | sub                 ecx, dword ptr [esp + 0x10]
            //   8b5678               | mov                 edx, dword ptr [esi + 0x78]
            //   0354240c             | add                 edx, dword ptr [esp + 0xc]

        $sequence_10 = { bb04000000 8bc1 f7e3 0344240c }
            // n = 4, score = 200
            //   bb04000000           | mov                 ebx, 4
            //   8bc1                 | mov                 eax, ecx
            //   f7e3                 | mul                 ebx
            //   0344240c             | add                 eax, dword ptr [esp + 0xc]

        $sequence_11 = { 0354240c 8b5a20 035c240c 33c0 8b3b }
            // n = 5, score = 200
            //   0354240c             | add                 edx, dword ptr [esp + 0xc]
            //   8b5a20               | mov                 ebx, dword ptr [edx + 0x20]
            //   035c240c             | add                 ebx, dword ptr [esp + 0xc]
            //   33c0                 | xor                 eax, eax
            //   8b3b                 | mov                 edi, dword ptr [ebx]

        $sequence_12 = { 50 ff95bc154000 85c0 7403 eb0c 58 }
            // n = 6, score = 200
            //   50                   | push                eax
            //   ff95bc154000         | call                dword ptr [ebp + 0x4015bc]
            //   85c0                 | test                eax, eax
            //   7403                 | je                  5
            //   eb0c                 | jmp                 0xe
            //   58                   | pop                 eax

        $sequence_13 = { 8bc8 48 c6857b27400000 8d8527164000 6a00 6a00 50 }
            // n = 7, score = 200
            //   8bc8                 | mov                 ecx, eax
            //   48                   | dec                 eax
            //   c6857b27400000       | mov                 byte ptr [ebp + 0x40277b], 0
            //   8d8527164000         | lea                 eax, [ebp + 0x401627]
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   50                   | push                eax

        $sequence_14 = { 6a00 ff9585144000 50 ff95e7144000 85c0 }
            // n = 5, score = 200
            //   6a00                 | push                0
            //   ff9585144000         | call                dword ptr [ebp + 0x401485]
            //   50                   | push                eax
            //   ff95e7144000         | call                dword ptr [ebp + 0x4014e7]
            //   85c0                 | test                eax, eax

        $sequence_15 = { 0f858c000000 03763c 813e50450000 0f857d000000 8b7c2410 b996000000 32c0 }
            // n = 7, score = 200
            //   0f858c000000         | jne                 0x92
            //   03763c               | add                 esi, dword ptr [esi + 0x3c]
            //   813e50450000         | cmp                 dword ptr [esi], 0x4550
            //   0f857d000000         | jne                 0x83
            //   8b7c2410             | mov                 edi, dword ptr [esp + 0x10]
            //   b996000000           | mov                 ecx, 0x96
            //   32c0                 | xor                 al, al

        $sequence_16 = { 833c85ebc3400000 7519 0fbec3 ff3485e3c34000 e8???????? }
            // n = 5, score = 100
            //   833c85ebc3400000     | cmp                 dword ptr [eax*4 + 0x40c3eb], 0
            //   7519                 | jne                 0x1b
            //   0fbec3               | movsx               eax, bl
            //   ff3485e3c34000       | push                dword ptr [eax*4 + 0x40c3e3]
            //   e8????????           |                     

        $sequence_17 = { 750f 8b4508 8b14857d504100 e9???????? }
            // n = 4, score = 100
            //   750f                 | jne                 0x11
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b14857d504100       | mov                 edx, dword ptr [eax*4 + 0x41507d]
            //   e9????????           |                     

        $sequence_18 = { 49 7432 8bd1 8b7c2414 8bdf 83c9ff }
            // n = 6, score = 100
            //   49                   | dec                 ecx
            //   7432                 | je                  0x34
            //   8bd1                 | mov                 edx, ecx
            //   8b7c2414             | mov                 edi, dword ptr [esp + 0x14]
            //   8bdf                 | mov                 ebx, edi
            //   83c9ff               | or                  ecx, 0xffffffff

        $sequence_19 = { 888831004100 46 ebd5 8935???????? }
            // n = 4, score = 100
            //   888831004100         | mov                 byte ptr [eax + 0x410031], cl
            //   46                   | inc                 esi
            //   ebd5                 | jmp                 0xffffffd7
            //   8935????????         |                     

        $sequence_20 = { 03f2 8bfe 83c604 fc }
            // n = 4, score = 100
            //   03f2                 | add                 esi, edx
            //   8bfe                 | mov                 edi, esi
            //   83c604               | add                 esi, 4
            //   fc                   | cld                 

        $sequence_21 = { ff30 e8???????? eb22 40 }
            // n = 4, score = 100
            //   ff30                 | push                dword ptr [eax]
            //   e8????????           |                     
            //   eb22                 | jmp                 0x24
            //   40                   | inc                 eax

        $sequence_22 = { c1c004 50 240f 0430 3c39 }
            // n = 5, score = 100
            //   c1c004               | rol                 eax, 4
            //   50                   | push                eax
            //   240f                 | and                 al, 0xf
            //   0430                 | add                 al, 0x30
            //   3c39                 | cmp                 al, 0x39

        $sequence_23 = { 3c0d 741f 3c0e 7431 b002 83c410 }
            // n = 6, score = 100
            //   3c0d                 | cmp                 al, 0xd
            //   741f                 | je                  0x21
            //   3c0e                 | cmp                 al, 0xe
            //   7431                 | je                  0x33
            //   b002                 | mov                 al, 2
            //   83c410               | add                 esp, 0x10

    condition:
        7 of them and filesize < 1523712
}
Download all Yara Rules