Loading story…
Virut.ce was documented as a widespread polymorphic Windows file-infector and backdoor that compromised executable files through entry-point rewriting and obscuring, while also infecting web content such as HTML, PHP, and ASP pages by inserting hidden iframes. Those injected pages were used to fetch newer malware builds through a PDF exploit chain, helping the threat maintain and refresh infections across compromised environments. Researchers noted that the malware paired heavy obfuscation with anti-emulation and anti-debugging techniques, and also attempted to disable security tools by terminating antivirus-related processes.
Technical analysis showed Virut.ce sustaining memory residency through aggressive process injection. The malware enabled SeDebugPrivilege, enumerated running processes, mapped a shared memory section named \BaseNamedObjects\houtVt into target processes, hooked NTDLL APIs, and launched remote threads to spread its code into processes including Winlogon.exe and explorer.exe. Its backdoor functionality relied on IRC-based command-and-control infrastructure including irc.zief.pl and proxim.ircgalaxy.pl, illustrating how the family combined classic file infection, web-script tampering, stealth, and live process compromise in a single malware platform.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
The Securelist analysis states that as of April to May 2010, no new Virut.ce versions had been detected, although further evolution remained possible.
Virut.ce propagation activity increased over time between May 2009 and May 2010, becoming one of the most widespread malware families observed on users' computers in that period.
A new Virut variant, Virut.ce, appeared in the first week of February 2009. It evolved into a polymorphic file-infecting virus and backdoor that also infected web files.
The Virut.q variant was largely discontinued during the second half of 2008.
The Virut family progressed through multiple variants and had reached Virut.q by around September 2007.
The first Virut variant, Virut.a, appeared in mid-2006, marking the beginning of the Virut malware family.
A SecureWorks analysis documented a newer Virut variant that wrapped its stripped-down IRC command-and-control traffic in a custom encryption scheme using a 32-bit session key derived from a custom rand() function seeded with RDTSC. The researcher showed the key could be recovered via known-plaintext analysis of the predictable initial "NICK" string, enabling decryption of sessions that revealed !get commands downloading additional malware such as Malware Doctor.
Securelist published a technical review detailing Virut.ce's polymorphic infection methods, web-file iframe insertion, IRC command-and-control, and anti-analysis techniques.
A September 2010 Virus Bulletin analysis described how W32/Virut.CE injects code into processes using a shared memory section, NTDLL API hooking, and remote threads to maintain memory residency.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 9 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported renewed activity and fresh analysis of **Hworm**—also tracked as **Houdini** and **njRAT**—showing the long-running remote access trojan continuing to evolve from earlier Delphi-based campaigns into newer fileless delivery chains. Earlier campaigns used self-extracting archives with Middle East and Mediterranean political lures and decoy content while the malware ran in the background, and researchers tied some development to semi-public builder tooling and a Delphi rewrite discussed in underground forums. The malware family supports broad remote administration functions including keylogging, screenshot capture, file management, browser password theft, persistence, and process injection. Recent analysis described a VBScript-based injector that uses **DynamicWrapperX**, base64-encoded components such as `DCOM_DATA`, `LOADER_DATA`, and `FILE_DATA`, and forced execution through 32-bit `wscript.exe` on 64-bit Windows systems before injecting the final payload into `msbuild.exe`. Across samples, Hworm/njRAT established persistence through the Windows **Run** registry key and copied itself into user-accessible paths, while command-and-control shifted from older HTTP-style traffic to mixed binary-and-ASCII TCP communications. Analysts also identified embedded configuration data including mutex values, installation paths, ports, and C2 infrastructure such as `chroms.linkpc.net` and `85.26.235.163:7777`, alongside anti-analysis checks for tools including Wireshark, Process Hacker, dnSpy, Sandboxie, and VMware or VirtualBox services.
Aug 15, 2026
LevelBlue SpiderLabs traced a multi-stage malware campaign to attacker-controlled open directories on `news4me[.]xyz` after SentinelOne quarantined a suspicious `Name_File.vbs` file on a compromised endpoint. The initial VBS launcher was heavily obfuscated with Unicode tricks and decoded a Base64 PowerShell command that fetched a seemingly benign PNG from Internet Archive, extracted an embedded .NET assembly dubbed `PhantomVAI`, and executed it directly in memory via `Reflection.Assembly::Load`, leaving little on disk. `PhantomVAI` then pulled additional components from the same infrastructure, including an obfuscated **Remcos RAT** payload and a PNG carrying a UAC bypass DLL for privilege escalation. Researchers said the same infrastructure exposed a broader reusable malware framework with multiple delivery paths and rotating payloads. Open directories hosted additional obfuscated VBS files, **XWorm** variants, **ScorpioRAT**, and a separate `/invoice/` infection chain that used a fake PDF ZIP, Internet Shortcut files, WebDAV, batch scripts, Cloudflare-backed domains, and Python-based payloads identified as **Kramer** malware. The campaign used nontraditional staging formats including `PNG`, `TXT`, `ZIP`, and shortcut-style files to support modular delivery, prompting recommendations to restrict VBS and BAT execution from user-writable directories, enforce constrained PowerShell with in-memory execution logging, and block WebDAV and suspicious `.xyz` domains tied to the operation.
Jun 29, 2026
Attackers ran a multi-stage information-stealing campaign against victims in Latin America and Asia Pacific by distributing password-protected archives disguised as pirated software. Trellix reported that the infection chain abused legitimate **Cisco Webex** binaries for **DLL sideloading**, which launched **HijackLoader** and then **Vidar Stealer** through an **AutoIt3** component, enabling theft of browser credentials and communication with command-and-control infrastructure. The campaign used several defense-evasion and post-compromise techniques, including a **COM-based UAC bypass**, adding **Windows Defender** exclusions, and injecting into **`MSBuild.exe`**. Trellix said the malware also fetched additional payloads and ultimately launched a cryptominer via **`AddInProcess.exe`**, describing the operation as a fresh and evasive threat with low detections in threat feeds despite clear execution-chain visibility in EDR telemetry.
Aug 14, 2026