{
  "family": "virut",
  "sample_count": 1578,
  "category": "file_infector",
  "description": "Virus:Win32/Virut is a highly complex, polymorphic file infector and botnet agent that has caused widespread disruption by irreversibly corrupting executable files across compromised networks.<br><br><b>What is Virut?</b><br>For general users, a Virut infection manifests as severe system instability, application crashes, and heavy network lag. For incident responders, Virut is an eradication nightmare. It is a parasitic file infector that prepends or appends its polymorphic code to all executable files (<code>.exe</code> and <code>.scr</code>) and HTML files it can find on local drives and mapped network shares. This means the malware spreads organically every time an infected legitimate application is run.<br><br><b>Infection Vectors & Threat Hunting</b><br>Virut typically enters a network via drive-by downloads, compromised websites, or as a payload dropped by other malware families. Once active, it hooks low-level Windows APIs (like <code>NtCreateFile</code> and <code>NtOpenFile</code>) to intercept file execution and inject its malicious code into clean binaries on-the-fly. It also connects to a robust IRC-based Command-and-Control (C2) botnet to download secondary payloads, such as the Waledac spambot or fake antivirus software.<br><br><b>Forensic Analysis & Impact</b><br>The impact of Virut is devastating because disinfection is often mathematically impossible without corrupting the host executable. The polymorphism ensures the virus signature changes constantly. Threat hunters should monitor for anomalous IRC traffic (often over port 80 to bypass egress filtering) and look for a sudden, massive spike in file modification times across the file system. Due to its aggressive file infection routines, a Virut outbreak often necessitates a complete network re-architecture.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "win32.virut",
    "virut.ce",
    "virut.nbp",
    "virut.a",
    "virux"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What does Virut do?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Infects files, provides backdoor access, and distributes additional malware."
      }
    },
    {
      "@type": "Question",
      "name": "How does Virut spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through infected executables, web files, and removable media."
      }
    },
    {
      "@type": "Question",
      "name": "Was Virut disrupted?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, a 2013 operation took down much of its command infrastructure."
      }
    }
  ],
  "faq_count": 3,
  "mitre_attack": [
    "T1105",
    "T1071.002",
    "T1546.015",
    "T1055",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1185",
      "name": "Browser Session Hijacking",
      "tactic": "Collection"
    },
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1546.015",
      "name": "Event Triggered Execution: Component Object Model Hijacking",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.002",
      "name": "Application Layer Protocol: File Transfer Protocols",
      "tactic": "Command and Control"
    }
  ],
  "containment_steps": [
    "Immediately isolate the infected machine from the network, as Virut will rapidly infect all accessible shared network drives.",
    "Assume all executable files (<code>.exe</code>, <code>.scr</code>) on the compromised system are permanently corrupted.",
    "Block outbound connections to known IRC C2 servers to prevent the endpoint from participating in DDoS attacks or downloading secondary payloads.",
    "Do not attempt to clean or disinfect the system; the only reliable remediation for a Virut infection is a complete bare-metal rebuild."
  ],
  "what_to_avoid": [
    "Avoid transferring any executable files or backups from the infected machine to a clean environment, as the infection travels with the files.",
    "Do not trust standard AV disinfection tools to successfully 'clean' Virut; they frequently damage the PE headers, rendering legitimate applications unusable."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}