{
  "family": "viking",
  "sample_count": 175,
  "category": "file_infector",
  "description": "Worm:Win32/Viking (also known as HLLP.Viking) is a classic, destructive network worm and file infector notorious for rapidly propagating across local networks, corrupting executable files, and causing severe system instability.<br><br><b>What is Viking?</b><br>For general users, a Viking infection causes significant disruption, often resulting in widespread application crashes and the inability to launch legitimate software. For incident responders, it represents a noisy, aggressive propagation threat. Viking is a true virus/worm hybrid; it seeks to infect every <code>.exe</code> file it can access while simultaneously attempting to copy itself to all reachable network shares.<br><br><b>Infection Vectors & Threat Hunting</b><br>Viking primarily spreads by users executing an already infected file or via open SMB network shares. Upon execution, the virus becomes memory-resident. It immediately drops a hidden executable (often named <code>rundl132.exe</code> or similar deceptive names) into the Windows directory and establishes persistence via the Registry Run keys. It then aggressively scans all local drives, targeting executable files. Viking appends its viral body to the legitimate file and modifies the entry point. Crucially, Viking often drops additional payloads, such as backdoors or generic trojan downloaders, to further compromise the host.<br><br><b>Forensic Analysis & Impact</b><br>The impact is widespread file corruption and massive operational disruption. EDR platforms frequently trigger a flood of alerts for 'Suspicious File Modification' or 'Executable Entry Point Altered' as Viking rapidly rewrites thousands of files. Incident responders will notice legitimate applications suddenly increasing in size. Network logs will show aggressive SMB scanning (port 445) as the worm attempts lateral movement.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1485",
    "T1055.001",
    "T1547.001",
    "T1091",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1091",
      "name": "Replication Through Removable Media",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1055.001",
      "name": "Process Injection: Dynamic-link Library Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Instantly sever the endpoint from the network to prevent the worm from iterating over open SMB shares and infecting files on central servers.",
    "Do not execute any files on the infected system, as running an infected file simply re-triggers the memory-resident infection cycle.",
    "Boot the infected machine from a known-clean, write-protected live OS (like a Linux Live USB) to safely scan and disinfect the drive offline.",
    "Utilize a specialized antivirus disinfection tool capable of carefully stripping the appended Viking viral body and restoring the original executable entry points."
  ],
  "what_to_avoid": [
    "Do not attempt to manually clean the machine while booted into the infected OS; the memory-resident virus will instantly reinfect files as you clean them.",
    "Avoid relying solely on file deletion; deleting infected files means deleting legitimate applications. Proper disinfection is required."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}