Overview

Worm:Win32/Viking (also known as HLLP.Viking) is a classic, destructive network worm and file infector notorious for rapidly propagating across local networks, corrupting executable files, and causing severe system instability.

What is Viking?
For general users, a Viking infection causes significant disruption, often resulting in widespread application crashes and the inability to launch legitimate software. For incident responders, it represents a noisy, aggressive propagation threat. Viking is a true virus/worm hybrid; it seeks to infect every .exe file it can access while simultaneously attempting to copy itself to all reachable network shares.

Infection Vectors & Threat Hunting
Viking primarily spreads by users executing an already infected file or via open SMB network shares. Upon execution, the virus becomes memory-resident. It immediately drops a hidden executable (often named rundl132.exe or similar deceptive names) into the Windows directory and establishes persistence via the Registry Run keys. It then aggressively scans all local drives, targeting executable files. Viking appends its viral body to the legitimate file and modifies the entry point. Crucially, Viking often drops additional payloads, such as backdoors or generic trojan downloaders, to further compromise the host.

Forensic Analysis & Impact
The impact is widespread file corruption and massive operational disruption. EDR platforms frequently trigger a flood of alerts for 'Suspicious File Modification' or 'Executable Entry Point Altered' as Viking rapidly rewrites thousands of files. Incident responders will notice legitimate applications suddenly increasing in size. Network logs will show aggressive SMB scanning (port 445) as the worm attempts lateral movement.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Technique	Name	Tactic
`T1091`	Replication Through Removable Media	Lateral Movement
`T1055.001`	Process Injection: Dynamic-link Library Injection	Defense Evasion
`T1485`	Data Destruction	Impact
`T1547.001`	Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder	Persistence
`T1105`	Ingress Tool Transfer	Command and Control

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_VIKING {
    meta:
        description = "Detects Viking (file_infector)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "viking" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Viking Activity
id: a4dede7fccd54a3e8a56ad51ac64e94f
status: experimental
description: Detects generic indicators of the viking malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*viking*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

Instantly sever the endpoint from the network to prevent the worm from iterating over open SMB shares and infecting files on central servers.
Do not execute any files on the infected system, as running an infected file simply re-triggers the memory-resident infection cycle.
Boot the infected machine from a known-clean, write-protected live OS (like a Linux Live USB) to safely scan and disinfect the drive offline.
Utilize a specialized antivirus disinfection tool capable of carefully stripping the appended Viking viral body and restoring the original executable entry points.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

Do not attempt to manually clean the machine while booted into the infected OS; the memory-resident virus will instantly reinfect files as you clean them.
Avoid relying solely on file deletion; deleting infected files means deleting legitimate applications. Proper disinfection is required.

Viking

Overview

MITRE ATT&CK Techniques

Generated Detections (Boilerplate)

YARA Rule

Sigma Rule

Containment & Response Steps

What to Avoid

References & External Analysis

Related Families (Category: file_infector)

Machine-readable

Ecosystem & Interactive Environments