Loading malware…
Virut is a long-running Windows malware family best known as a polymorphic file-infector that also functions as an IRC-controlled backdoor and botnet. First observed in 2006, it became one of the most prevalent file-infecting threats of its era and was widely associated with large-scale criminal monetization through pay-per-install operations. Virut infects Windows executable files and, in prominent variants such as Virut.ce, also infects web-related files including HTML, PHP, and ASP by inserting hidden iframe code to pull additional malicious content. It has also been reported spreading through removable media such as USB drives, network shares, file-sharing ecosystems, and crack or keygen-themed software bundles.
Technically, Virut is notable for combining classic parasitic infection with advanced polymorphism and strong evasion. Variants use entry-point modification techniques including entry-point obscuring and rewriting of PE metadata, append their body to the final PE section, and mutate decryptors and restoration logic frequently to hinder static detection. Analyses of Virut.ce describe extensive junk-code insertion, anti-emulation checks, and anti-debugging measures. The malware also injects code into running processes, enables debug privileges, maps shared sections into remote processes, hooks NTDLL routines related to file and process activity, and creates remote threads to maintain memory residency and broaden execution inside the infected host.
Virut’s botnet functionality is centered on IRC-based command and control. Infected systems connect to operator-controlled IRC infrastructure, join channels, and receive commands, including instructions to download and execute additional payloads. Some newer variants wrapped this IRC traffic in a lightweight custom encryption scheme while preserving the underlying IRC semantics. Virut has been used as a malware distribution platform for other families, including banking trojans, spambots, and rogue security software, reinforcing its role as a loader and pay-per-install service within the cybercrime ecosystem.
The malware also exhibits defensive and disruptive behavior on compromised systems. Reported variants terminate security-product processes and contain strings and logic consistent with antivirus interference. Virut has been described as capable of information theft, though its most consistently documented core behaviors are file infection, backdoor access, process injection, and secondary payload delivery.
Virut infected hundreds of thousands of systems globally and remained active for years despite repeated disruption efforts. Its command infrastructure relied heavily on domain-based control, and defenders documented both sinkholing operations and fallback mechanisms including domain generation in later reporting. Virut is historically significant as one of the most successful polymorphic Windows file infectors to evolve into a durable criminal botnet and malware distribution platform.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
18 distinct techniques documented for this family, organized by ATT&CK tactic.
Virut creates a remote thread using a call to CreateRemoteThread, with dwCreationFlags equal to 0. It executes the thread immediately. | The main idea behind code injection is that the malware embeds itself into a running process to maintain residency.
Virut’s code injection starts by modifying the access token’s privilege... Virut calls for the LookupPrivilegeValueA API to get the locally unique identifier (LUID) for SeDebugPrivilege... This is immediately followed by a call to the ZwAdjustPrivilegesToken API.
Since a different key is used each time, simple visual analysis of several captured network streams will reveal nothing useful to an observer, making it appear as though Virut is using strong encryption.
Virut creates a remote thread using a call to CreateRemoteThread, with dwCreationFlags equal to 0. It executes the thread immediately. | The main idea behind code injection is that the malware embeds itself into a running process to maintain residency.
Virut’s code injection starts by modifying the access token’s privilege... Virut calls for the LookupPrivilegeValueA API to get the locally unique identifier (LUID) for SeDebugPrivilege... This is immediately followed by a call to the ZwAdjustPrivilegesToken API.
NASK ... began assuming control over 23 .pl domains that were being used to operate the Virut network. The company has redirected traffic from those domains to sinkhole.cert.pl
The reason for Virut's success is simple - by infecting other Windows executables, it is able to spread not only as executables are copied from one computer to another normally, but by piggybacking on other malware as those threats are spread through various means such as peer-to-peer filesharing, browser exploits, and network worm activity.
When Virut gets a foothold on a system, it connects to a command-and-control server using the IRC protocol in order to download additional malware.
26 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Windows file-infecting virus and botnet malware family that spreads by infecting executables and piggybacking on other malware distribution channels. Once installed, it connects to IRC-based command-and-control infrastructure, uses an encrypted protocol in newer variants, and downloads additional malware under a pay-per-install scheme.
A fast-mutating polymorphic file-infecting virus and backdoor that infects executable, HTML, PHP, and ASP files; uses EPO and entry-point rewriting, anti-emulation and anti-debugging, injects into processes such as explorer.exe, connects to IRC servers for command-and-control, terminates security processes, and spreads via infected executables and software cracks/keygens.
A worm associated with 31 command-and-control servers identified by Spamhaus.
Virut is a worm and botnet malware family with file-infection capabilities that spreads via removable drives and network shares. The content states it was first detected in 2006, grew to more than 300,000 compromised computers, and used domains in .pl, .ru, and .at for botnet control. It also dropped other malware as part of a pay-per-install model.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.