PE_SALITY.RL

 Analysis by: Kathleen Notario
 Modified by: Christopher Daniel So

 PLATFORM:

Windows 2000, Windows XP, Windows Server 2003

 OVERALL RISK RATING:
 DAMAGE POTENTIAL:
 DISTRIBUTION POTENTIAL:
 REPORTED INFECTION:
 INFORMATION EXPOSURE:

  • Threat Type: File infector

  • Destructiveness: No

  • Encrypted: Yes

  • In the wild: Yes

  OVERVIEW

Infection Channel:

Infects files, Copies itself in all available physical drives


This file infector drops copies of itself in all removable and physical drives found in the system. It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

  TECHNICAL DETAILS

File Size:

Varies

File Type:

PE

Memory Resident:

Yes

Initial Samples Received Date:

21 Aug 2010

Payload:

Drops files, Connects to URLs/IPs

Autostart Technique

This file infector registers its dropped component as a system service to ensure its automatic execution at every system startup. It does this by creating the following registry entries:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\amsint32
Type = "1"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\amsint32
Start = "3"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\amsint32
ErrorControl = "1"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\amsint32
ImagePath = "\??\%System%\drivers\{random file name}.sys"

HKEY_LOCAL_MACHINE\System\CurrentControlSet\
Services\amsint32
DisplayName = "amsint32"

Other System Modifications

This file infector adds the following registry keys:

HKEY_CURRENT_USER\Software\{random characters}

It adds the following registry entries:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center
AntiVirusDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
AntiVirusOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
FirewallOverride = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UacDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Security Center\Svc
UpdatesDisableNotify = "1"

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\
Windows\CurrentVersion\policies\
system
EnableLUA = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
EnableFirewall = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DoNotAllowExceptions = "0"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile
DisableNotifications = "1"

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\
Services\SharedAccess\Parameters\
FirewallPolicy\StandardProfile\AuthorizedApplications\
List
{malware path and file name} = "{malware path and file name}:*:Enabled:ipsec"

It modifies the following registry entries:

HKEY_CURRENT_USER\Software\Microsoft\
Windows\CurrentVersion\Explorer\
Advanced
Hidden = "2"

(Note: The default value data of the said registry entry is 1.)

File Infection

This file infector infects the following file types:

  • .EXE
  • .SCR

Propagation

This file infector drops copies of itself in all removable and physical drives found in the system.

It drops an AUTORUN.INF file to automatically execute the copies it drops when a user accesses the drives of an affected system.

The said .INF file contains the following strings:

[AutoRun];
{garbage characters}
shELl\\EXplOrE\\cOmMand= {random file name}.exe;
{garbage characters}
sheLL\\OPen\\cOMMaND= {random file name}.exe;
{garbage characters}
shEll\\open\\DefAuLt=1;
{garbage characters}
OPen= {random file name}.exe;
{garbage characters}
shelL\\aUToPLAy\\command = {random file name}.exe

Dropping Routine

This file infector drops the following files:

  • %System%\drivers\{random file name}.sys - detected as RTKT_SALITY.BA

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

Other Details

This file infector attempts to access the following websites to download files, which are possibly malicious:

  • http://{BLOCKED}3.{BLOCKED}3.19.14/logo.gif
  • http://{BLOCKED}metgrup.com/images/logosa.gif
  • http://{BLOCKED}asa.com/images/logos.gif
  • http://{BLOCKED}tara.com/logof.gif
  • http://{BLOCKED}nt-eg.com/images/logosa.gif
  • http://{BLOCKED}wel.fm.interia.pl/logos.gif
  • http://{BLOCKED}lie.com/images/logos.gif
  • http://www.{BLOCKED}becreatives.com/logos.gif
  • http://www.{BLOCKED}ogullari.com/logof.gif
  • http://{BLOCKED}uncil.ya.funpic.de/images/logos.gif

It does the following:

  • It deletes the file %System%\drivers\{random file name}.sys after adding and running the service amsint32.

(Note: %System% is the Windows system folder, where it usually is C:\Windows\System32 on all Windows operating system versions.)

NOTES:

Files with file size of 30 MB and above are corrupted by this malware after system infection.

  SOLUTION

Minimum Scan Engine:

8.900

Step 1

AUTOMATIC REMOVAL INSTRUCTIONS

To automatically remove this malware from your system, use Trend Micro's special fixtool. Download, extract, and run the said fixtool in the same folder where your latest Trend Micro pattern file is located. For more details, refer to the fixtool's incorporated text file.

MANUAL REMOVAL INSTRUCTIONS

Step 2

Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.

Step 3

Identify and terminate files detected as PE_SALITY.RL

[ Learn More ]
  1. Windows Task Manager may not display all running processes. In this case, please use a third-party process viewer, preferably Process Explorer, to terminate the malware/grayware/spyware file. You may download the said tool here.
  2. If the detected file is displayed in either Windows Task Manager or Process Explorer but you cannot delete it, restart your computer in safe mode. To do this, refer to this link for the complete steps.
  3. If the detected file is not displayed in either Windows Task Manager or Process Explorer, continue doing the next steps.

Step 4

Delete this registry value

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry.

  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • FirewallOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UacDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • UpdatesDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
    • AntiVirusDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • AntiVirusOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • FirewallDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • FirewallOverride = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • UacDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
    • UpdatesDisableNotify = "1"
  • In HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system
    • EnableLUA = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • EnableFirewall = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DoNotAllowExceptions = "0"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
    • DisableNotifications = "1"
  • In HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
    • {malware path and file name} = "{malware path and file name}:*:Enabled:ipsec"
  • In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\amsint32
    • Type = "1"
  • In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\amsint32
    • Start = "3"
  • In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\amsint32
    • ErrorControl = "1"
  • In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\amsint32
    • ImagePath = "\??\%System%\drivers\{random file name}.sys"
  • In HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\amsint32
    • DisplayName = "amsint32"

Step 5

Delete this registry key

[ Learn More ]

Important: Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this step only if you know how or you can ask assistance from your system administrator. Else, check this Microsoft article first before modifying your computer's registry. Before you could do this, you must restart in Safe Mode. For instructions on how to do this, you may refer to this page If the preceding step requires you to restart in safe mode, you may proceed to edit the system registry.

  • In HKEY_CURRENT_USER\Software
    • {random characters}

Step 6

Restore these modified registry values

[ Learn More ]

Important:Editing the Windows Registry incorrectly can lead to irreversible system malfunction. Please do this only if you know how to or you can seek your system administrator's help. You may also check out this Microsoft article first before modifying your computer's registry.

  • In HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
    • From: Hidden = "2"
      To: Hidden = "1"

Step 7

Search and delete AUTORUN.INF files created by PE_SALITY.RL that contain these strings

[ Learn More ]
[AutoRun];
{garbage characters}
shELl\EXplOrE\cOmMand= {random file name}.exe;
{garbage characters}
sheLL\OPen\cOMMaND= {random file name}.exe;
{garbage characters}
shEll\open\DefAuLt=1;
{garbage characters}
OPen= {random file name}.exe;
{garbage characters}
shelL\aUToPLAy\command = {random file name}.exe

Step 8

Scan your computer with your Trend Micro product to delete files detected as PE_SALITY.RL. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

NOTES:

Mitigating this malware using your Trend Micro product is done doing the following steps:

  1. Ensure that product engines and patterns are all updated.
    (Note: Make sure that Virus Clean-up Template uses pattern version 1284 or higher.)
  2. For enterprise products, enable the following modules to block malware from spreading:
    1. Real-time scan's Scan Network Drive
    2. Behavioral Monitoring
    3. WRS or Web Reputation Services
    4. DAC or Device Access Control
  3. If PE_SALITY.RL is detected in your system, immediately perform a Manual Scan or assign a Scheduled Scan in the infected system and then reboot system. This ensures that every malware infection has been removed.


Did this description help? Tell us how we did.