Black friday Up to 3 extra licenses FOR FREE + Special offer for TI LOOKUP Get it now

Sality

53
Global rank
18 infographic chevron month
Month rank
16 infographic chevron week
Week rank
0
IOCs

Sality is a highly sophisticated malware known for infecting executable files and rapidly spreading across networks. It primarily creates a peer-to-peer botnet that is used for malicious activities such as spamming, data theft, and downloading additional malware. Sality has strong persistence mechanisms, including disabling security software, making it difficult to remove. Its ability to spread quickly and silently, along with its polymorphic nature, allows it to evade detection by traditional antivirus solutions.

Botnet
Type
ex-USSR
Origin
1 June, 2003
First seen
15 March, 2025
Last seen

How to analyze Sality with ANY.RUN

Type
ex-USSR
Origin
1 June, 2003
First seen
15 March, 2025
Last seen

IOCs

IP addresses
206.189.61.126
37.230.104.89
78.46.2.155
84.114.219.90
81.180.234.176
220.121.134.142
71.95.133.164
81.181.64.5
76.104.215.8
78.96.105.81
72.218.137.25
129.74.157.231
62.90.21.54
80.54.102.172
212.12.166.36
201.24.159.221
87.121.209.81
164.125.131.62
77.77.35.67
85.17.167.196
Domains
shumbola.vo.uz
juniorboysown.com
ahmediye.net
apple-pie.in
althawry.org
kukutrustnet777888.info
al-somow.com
klkjwre9fqwieluoi.info
omeroglunakliyat.net
bharatisangli.in
brucegarrod.com
padrup.com
amsamex.com
klkjwre77638dfqwieuoi888.info
rocesterfc.com
jewellerybazaar.net
ptcgic.com
cafe-net.pl
dreamdrive.biz
dehaspas.com
URLs
http://apadanapub.com/logo.gif
http://alsharqpaper.net/logo.gif
http://akdari.com/images/logo.gif
http://akcainsaat.com/img/logo.gif
http://adiyamanlicigkoftecim.com/images/logo.gif
http://jsthomes.com/images/logo.gif
http://www.legalbilgisayar.com/img/logo.gif
http://kuplu.bel.tr/images/logo.gif
http://koonadance2.com/images/logo.gif
http://www.ecole-saint-simon.net/index_top/logo.gif
http://lazarea.ro/images/logo.gif
http://kulppasur.com/logo.gif
http://www.ledyazilim.com/logo.gif
http://www.lafyeri.com/images/logo.gif
http://www.tothispeed.com/test/menu.jpg
http://nasr-rashwan.leadhoster.com/bottom.gif
http://shumbola.vo.uz/images/bottom.gif
http://soneo.fr/img/xs.jpg
http://rocesterfc.com/images/xs.jpg
http://apadanapub.com/logof.gif
Last Seen at

Recent blog posts

post image
New Pre-Installed Dev Tools for Deep Sandbox...
watchers 294
comments 0
post image
AI Safety: Key Threats and Solutions 
watchers 391
comments 0
post image
5 Common Evasion Techniques in Malware 
watchers 558
comments 0

What is Sality malware?

Sality is a file-infecting virus and botnet malware first observed around 2003. It primarily targets Windows systems, infecting executable files (.exe) and spreading rapidly across networks and removable drives.

Over time, it has become highly persistent and adaptive, evading traditional security measures through polymorphism, constantly changing its code to avoid detection.

Similar to other botnet malware like Phorpiex and Mirai, Sality has infected hundreds of thousands of computers globally, creating a massive botnet. The malware operators use this network for various purposes, ranging from relatively "benign" tasks like generating spam to more malicious activities, such as distributing password stealers. In 2011, one of the programs distributed through the Sality botnet focused on stealing web credentials, particularly targeting Facebook and Google Blogger accounts.

Get started today for free

Analyze malware and phishing in a fully-interactive sandbox

Create free account

Sality malware technical details

The primary functionality of Sality malware includes:

  • Spreads by infecting executable files and removable drives.
  • Uses polymorphic techniques to change its code with every infection, making it harder for antivirus software to detect or create consistent signatures.
  • Creates a P2P botnet for malicious activities like data theft and DDoS attacks.
  • Disables antivirus and firewall protections and uses rootkit techniques to hide its presence on the system.
  • Modifies the infected system’s hosts file to block access to security websites, preventing the user from downloading tools or updates that might detect or remove the virus.
  • Allows attackers to update and control infected systems remotely.

Sality connects infected machines to command and control (C2) servers or other infected systems within its botnet. This allows attackers to issue commands, download additional malware, and update the virus, ensuring it remains persistent and adaptive in its attack methods. Through this botnet, Sality can be used for a wide range of malicious activities, including:

  • Spamming
  • Distributed Denial of Service (DDoS) attacks
  • Data theft
  • Downloading additional malware

The data exchanged between the infected system and C2 servers is often encrypted, making it difficult for security experts to analyze the malware's activities.

Sality malware execution process

To see how Sality operates, let’s upload its sample into the ANY.RUN sandbox.

Once the Sality malware is executed, the stub decrypts and runs a secondary code segment known as the loader. The loader operates in a separate thread within the infected process and is responsible for executing the malware's main payload.

Sality actively targets security software by terminating antivirus-related processes and deleting files critical to system security. It may also modify system settings to reduce security levels and block the execution of security tools.

Sality malware in ANY.RUN Sality malware analyzed in the ANY.RUN sandbox

The malware is capable of stealing sensitive information, such as cached passwords and keystrokes, and can search for email addresses to send spam. It communicates with remote command and control (C2) servers, often utilizing a peer-to-peer (P2P) network to download additional malicious payloads or updates.

Modern Sality variants can form botnets, enabling attackers to control multiple infected machines. The botnets can be used for various malicious activities, including distributed denial-of-service (DDoS) attacks and further malware propagation.

Sality can also download and execute other malware, often through a preconfigured list of peers within its P2P network, allowing it to expand its capabilities and maintain persistence on infected systems.

Use ANY.RUN free for 14 days

Try the full power of interactive analysis

Start your free trial

Sality malware distribution methods

Sality malware employs several distribution methods that allow it to spread widely across networks and systems:

  • File infection: Sality primarily infects executable files (.exe) on infected machines, which helps it spread as these files are shared or transferred across systems.
  • Removable drives: The malware spreads through infected USB drives, external hard drives, and other removable media. When these drives are connected to other machines, Sality automatically infects them.
  • Network shares: It can spread across local networks by infecting shared folders and files, making it highly effective in corporate or organizational environments with multiple connected systems.
  • Peer-to-Peer (P2P) botnet: Sality creates a decentralized botnet, enabling it to communicate with other infected machines, spreading its payload and receiving updates from the attacker.
  • Self-replication: Once inside a system, Sality can modify system files, allowing it to replicate itself and infect more files and applications.

Gathering threat intelligence on Sality malware

To collect up-to-date intelligence on Sality and its latest variants, use Threat Intelligence Lookup. The service helps you search across a vast database of quality threat data sourced from millions of malware analysis sessions conducted in the ANY.RUN sandbox. It lets you use over 40 different search parameters and their combinations, including IPs, domains, command line artifacts, and process names.

Let's use a mutex fragment found in one Sality sample to find more samples. To do this, we'll submit the following query: syncObjectName:".EXEM_"

Sality query in ANY.RUN Sality mutex query in Threat Intelligence Lookup

The service returns one hundred sandbox sessions that we can explore further.

Get a 14-day free trial of Threat Intelligence Lookup along with the ANY.RUN sandbox

Conclusion

Sality’s ability to spread through infected files, disable security software, and form a botnet makes it a potential threat. Its focus on persistence and evading detection highlights the need for strong security measures. To effectively protect against Sality, it's important to use tools like malware sandboxes to thoroughly analyze suspicious files and detect threats early.

ANY.RUN offers a powerful solution, allowing users to safely examine and understand threats like Sality in real-time. By utilizing ANY.RUN, you can quickly detect and neutralize malware before it can cause harm to your systems.

Sign up for a free ANY.RUN account today and start analyzing malware with no limits!

HAVE A LOOK AT

DarkTortilla screenshot
DarkTortilla
darktortilla
DarkTortilla is a crypter used by attackers to spread harmful software. It can modify system files to stay hidden and active. DarkTortilla is a multi-stage crypter that relies on several components to operate. It is often distributed through phishing sites that look like real services.
Read More
zgRAT screenshot
zgRAT
zgrat
zgRAT is a malware known for its ability to infect systems and exfiltrate sensitive data to command-and-control (C2) servers. It is primarily distributed through loader malware, as well as phishing emails. zgRAT employs various advanced techniques, including process injection and code obfuscation, to evade detection and maintain persistence on infected systems. The malware can also spread via USB drives and uses popular messaging platforms like Telegram and Discord for data exfiltration.
Read More
Black Basta screenshot
Black Basta
blackbasta
Black Basta is a ransomware-as-a-service operated by Storm-1811. It emerged in 2022 and uses double extortion tactics, encrypting data and stealing it for ransom. The malware often gains access through spear-phishing and uses tools like QakBot and Cobalt Strike. It's known for exploiting system vulnerabilities and using advanced obfuscation techniques.
Read More