Loading malware…
Dark Avenger is the commonly used name for both a DOS-era virus and the pseudonym of its Bulgarian author from Sofia. The malware first appeared in early 1989 and became internationally notorious in the early 1990s. It is described as a highly infectious file infector that can infect executable files when they are opened or copied while the virus is memory-resident, making it a classic fast infector. Contemporary sources also describe the Dark Avenger.1800 variant as introducing two notable behaviors: rapid infection of files on open, and gradual destructive activity through random disk-sector overwrites. Specifically, the virus was reported to overwrite a random disk sector every 16th run of an infected program, progressively corrupting files and directories. Corrupted files could contain the string "Eddie lives... somewhere in time!". The virus spread worldwide, including to Western Europe, the USSR, the United States, and East Asia. The broader Dark Avenger body of work is also associated with multiple other viruses, including V2000, V2100, 651, Diamond, Nomenklatura, 512, 800, 1226, Proud, Evil, Phoenix, Anthrax, and Leech, and with use of bulletin board systems to distribute virus source code. Some of Dark Avenger's later malware used the Mutation Engine (MtE), a polymorphic engine designed to alter virus signatures and hinder antivirus detection. The content also notes strings seen in some related samples such as "Zopy (sic) me – I want to travel," "Only the Good die young...," and "Copyright (C) 1989 by Vesselin Bontchev." High-confidence associations in the content tie the malware to the Dark Avenger pseudonym and to DOS/PC environments; no more specific modern targeting information is provided.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct techniques documented for this family, organized by ATT&CK tactic.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Fast infector that infects programs when they are opened, not only when executed.
Highly infectious file-infecting computer virus family attributed to the Dark Avenger author; infects executable files when active in memory (even on open/copy) and includes destructive behavior by overwriting random disk sectors periodically, progressively corrupting data. Some variants incorporate a mutation engine (MtE) to evade signature-based detection by changing their code/signature.
A fast infector that infects programs when they are opened, not just when executed.
Fast-infecting file virus that caused slow, insidious disk damage by randomly writing garbage to sectors and infecting files when opened.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.