Definition of the Day: Metamorphic Viruses

A metamorphic virus is a class of viruses that call to mind the movie ‘Terminator.’ One of the most infectious and complicated viruses, metamorphic viruses are capable of changing themselves by translating, editing and rewriting their own code. Antivirus programs have a great difficulty detecting metamorphic viruses because the virus changes its code structure and breaks the pattern-matching searching that antivirus programs rely on to identify viruses.

A metamorphic virus is very difficult to write due to its complexity and the need to write an ‘engine’ for the virus that rewrites its own code. This requires extensive computer science skills.

One of the most famous metamorphic viruses is Zmist (also known as Z0mbie.Mistfall) Written by the Russian virus writer known as Z0mbie, Zmist was the first of its type to use a technology called “code integration.” In layman’s terms, Zmist decompiles files to their smallest elements and then moves code blocks out of the way to insert itself. It then regenerates the file with Zmist hidden within it. Other famous metamorphic files include Win32/Simile — also known as Etap and MetaPHOR.

Share this post

Share on facebook
Share on twitter
Share on linkedin
Share on print
Share on email