{
  "family": "parite",
  "sample_count": 163,
  "category": "file_infector",
  "description": "Virus:Win32/Parite (often Win32/Parite.B) is a highly pervasive, extremely polymorphic executable file infector (virus) that aggressively self-replicates by injecting its malicious code into every <code>.exe</code> and <code>.scr</code> file on local and networked drives.<br><br><b>Understanding Parite</b><br>To the end-user, a Parite infection causes widespread software corruption, bizarre application crashes, and extreme system slowdowns. For incident responders, Parite is a nightmare scenario of lateral movement and file destruction. Unlike modern trojans that hide, Parite is a true virus; its primary goal is aggressive propagation. It employs extreme polymorphism, meaning the viral code it injects into each executable is encrypted differently every single time, making standard hash-based detection entirely useless.<br><br><b>Execution and Evasion Strategies</b><br>Parite primarily spreads by users executing an already infected file, often from shared network drives. Upon execution, the virus becomes memory-resident. It immediately drops a randomly named, highly obfuscated DLL (e.g., <code>xxx.tmp</code>) into the Windows <code>%Temp%</code> directory and injects it into the <code>explorer.exe</code> process. From this trusted process, Parite aggressively scans all local drives and mapped network shares, targeting and infecting every executable file it finds. It appends its encrypted viral body to the end of the legitimate file and modifies the entry point to execute the virus before the original application.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive operational disruption and file corruption. EDR platforms frequently trigger a flood of alerts for 'Suspicious File Modification' or 'Executable Entry Point Altered' as Parite rapidly rewrites thousands of files. Incident responders will notice legitimate applications suddenly increasing in size. The presence of randomly named, locked <code>.tmp</code> DLL files in the Temp directory is a classic Parite IoC.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1485",
    "T1055.001",
    "T1091",
    "T1129",
    "T1027.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1027.002",
      "name": "Obfuscated Files or Information: Software Packing",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "id": "T1129",
      "name": "Shared Modules",
      "tactic": "Execution"
    }
  ],
  "containment_steps": [
    "Instantly sever the endpoint from the network to prevent the virus from iterating over open SMB shares and infecting files on central servers.",
    "Do not execute any files on the infected system, as running an infected file simply re-triggers the memory-resident infection cycle.",
    "Boot the infected machine from a known-clean, write-protected live OS (like a Linux Live USB) to safely scan and disinfect the drive offline.",
    "Utilize a specialized antivirus disinfection tool capable of carefully decrypting the polymorphic Parite body, stripping it, and restoring the original entry points."
  ],
  "what_to_avoid": [
    "Do not attempt to manually clean the machine while booted into the infected OS; the memory-resident virus will instantly reinfect files as you clean them.",
    "Avoid relying solely on file deletion; deleting infected files means deleting legitimate applications. Proper disinfection is required to save the data."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}