{
  "family": "xorer",
  "sample_count": 25,
  "category": "trojan",
  "description": "Virus:Win32/Xorer is a highly aggressive, self-replicating file infector virus that systematically corrupts executable files and HTML documents across local drives and network shares, severely impacting system stability and requiring extensive remediation.<br><br><b>Understanding Xorer</b><br>To the victim, a Xorer infection causes widespread application failure; programs refuse to launch or crash immediately. For a security analyst, Xorer is a classic, destructive parasitic virus. Unlike Trojans which simply drop a payload, a file infector like Xorer actively searches for legitimate `.exe` and `.html` files on the hard drive and physically appends its malicious code to them. When the user attempts to run a legitimate application, the virus code executes first.<br><br><b>Execution and Infection Mechanics</b><br>Xorer spreads via malicious downloads or lateral movement across SMB shares. Upon execution, it establishes persistence by dropping a copy of itself into the `%SystemRoot%` or `%System32%` directory and creating a Registry Run key (`T1547.001`). The virus then initiates a rapid traversal of all accessible logical drives (`T1083`). It injects its malicious assembly code into the `.reloc` or `.text` sections of legitimate PE (Portable Executable) files (`T1055.009`). Furthermore, it alters `.html` and `.htm` files, injecting malicious VBScript or IFrames designed to exploit browsers that open the infected documents.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is massive data corruption and system instability. EDR platforms will detect rapid, unauthorized modifications to hundreds of executable files across the system. File integrity monitoring (FIM) systems will alert on the changed hashes of core OS binaries. Network logs may show SMB scanning as the virus attempts to infect adjacent file shares (`T1021.002`).",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1021.002",
    "T1055.009",
    "T1547.001",
    "T1485",
    "T1083"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1055.009",
      "name": "Process Injection: PE Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactic": "Discovery"
    },
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Instantly sever the infected endpoint from the network to halt the virus from traversing SMB shares and infecting files on central file servers.",
    "Do not attempt to run standard administrative tools from the infected OS, as the executables (like taskmgr.exe) may themselves be infected.",
    "Boot the system into a clean, offline recovery environment (e.g., Windows PE or a Linux Live USB) to scan and clean the file system.",
    "Utilize a specialized antivirus cleaning utility designed for parasitic viruses; standard deletion will destroy the host file, a cleaner will attempt to extract the virus code and repair the file."
  ],
  "what_to_avoid": [
    "Do not trust any executable file on the infected machine, including incident response tools, until the system has been cleaned offline.",
    "Avoid backing up the infected files without explicit quarantine procedures, as you will simply be backing up the virus."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}