Method of Infection

When executed, Win32/Sality.AA drops a malicious component file to:


%System%\drivers\<random filename>.sys


This component is a device driver that acts as a 'rootkit' at kernel level; it allows the virus to hide itself in the compromised system by changing data structures in the kernel and hiding its malicious activity. This 'rootkit' method only functions on Windows NT-based operating systems, such as NT/2000/XP/2003.


Sality.AA also adds the following registry entry as a part of the device driver installation routine:


HKLM\SYSTEM\CurrentControlSet\Services\abp470n5


It adds the following text to the "system.ini" file located in the %Windows% directory:


[MCIDRV_VER]
DEVICEMB=<random number>


It also adds the following registry key with numerous random subkeys and entries needed for its malicious routine:


HKCU\Software\<computer name><3 random numbers>


For example:


HKCU\Software\JohnSmith498


Note: %System% and %Windows% are variable locations. The malware determines the location of these folders by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95, 98 and ME is C:\Windows\System; and for XP is C:\Windows\System32.The default installation location for the Windows directory for Windows 2000 and NT is C:\Winnt; for 95,98 and ME is C:\Windows; and for XP and Vista is C:\Windows.


Back to top
Method of Distribution
Via File Infection

Win32/Sality.AA is a polymorphic virus that attempts to spread by file infection. It looks for Win32 PE executable files with .EXE or .SCR file extensions, and infects any such files found on the system by appending the virus body to the host file.

Via Networks/Removable Drives

The virus also attempts to propagate by copying itself with a random filename to network drives, including all removable disk drives. Sality.AA also creates an "autorun.inf" file in these drives so that the virus executes when it is accessed.