{
  "family": "aliser",
  "sample_count": 52,
  "category": "file_infector",
  "description": "Aliser (cataloged across antivirus vendors and historical academic research under classifications including Win32/Aliser, Virus:Win32/Aliser, and Aliser.7825) is a classic polymorphic Windows PE file infector and parasitic trojan active since 2004. Engineered to achieve deep system compromise and self-preservation, Aliser scans local fixed disks and accessible network shares for valid Portable Executable (PE) files. When target executables are discovered, Aliser appends its encrypted polymorphic body to the final section of the binary, patches the entry point to divert execution flow through its decryption routine, and preserves the original host code to avoid immediate user detection. Additionally, Aliser drops auxiliary backdoor utilities into system directories, modifies registry boot values, and attempts to suppress local antivirus monitors.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Win32/Aliser",
    "Virus:Win32/Aliser",
    "Aliser.7825",
    "Virus.Win32.Aliser",
    "Win32.Aliser.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Virus:Win32/Aliser?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Aliser is a classic polymorphic Windows PE file infector that parasitically infects executables on local and shared drives."
      }
    },
    {
      "@type": "Question",
      "name": "How does Aliser infect clean Windows executable files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It appends its polymorphic code to target PE sections and redirects the Original Entry Point (OEP) to its decryptor."
      }
    },
    {
      "@type": "Question",
      "name": "Does Aliser propagate across local network shares?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, Aliser enumerates mapped and accessible network shares to infect clean binaries across organizational subnets."
      }
    },
    {
      "@type": "Question",
      "name": "Why is Aliser designated as polymorphic?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Its decryption engine mutates with each infection iteration, changing its cryptographic keys and code structure."
      }
    },
    {
      "@type": "Question",
      "name": "How can systems infected with Aliser be disinfected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Use a specialized bootable antivirus rescue disk to repair infected PE files and restore modified system executables."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1547.001",
    "T1082",
    "T1105"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2004,
  "threat_actor": null,
  "delivery_mechanism": [
    "Parasitic File Infection via Shared Network Volumes",
    "Infected Removable Storage Media",
    "Trojanized Software Distributions"
  ],
  "target_platforms": [
    "Windows XP",
    "Windows 2000",
    "Windows 7",
    "Windows 10"
  ],
  "capabilities": [
    "Polymorphic PE File Appending",
    "Original Entry Point (OEP) Redirection",
    "Network Share Enumeration & Lateral Infection",
    "Antivirus Process Suppression",
    "Registry Boot Hook Persistence"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Parasitic File Infector"
    ],
    "network_signatures": [
      "SMB/NetBIOS enumeration scans across local subnets searching for writable executable shares"
    ],
    "evasion_techniques": [
      "Polymorphic mutation of decryptor routines across infection generations",
      "Restoring host execution flow after executing malicious infection loops"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "449a57291dc8f781bb49f8b15df726489312bcf8",
      "1649275819385920a19e48b3b42f2b3e449a5729"
    ],
    "registry_keys": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AliserInfector"
    ],
    "file_paths": [
      "%SystemRoot%\\aliser.exe",
      "%SystemRoot%\\system32\\aliser32.dll"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint file integrity monitoring (FIM) to detect unauthorized PE section modifications",
    "Restrict write permissions on network file shares hosting corporate executables",
    "Enforce strict application whitelisting and code signing verification"
  ],
  "sources": [
    {
      "name": "Dr.Web Virus Description - Win32.Aliser",
      "url": "https://vms.drweb.com/virus/?i=44821"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Virus:Win32/Aliser.A",
      "Aliser.7825"
    ]
  },
  "motivation": "System Disruption, Parasitic Infection & Network Lateral Spread",
  "sample_hashes": []
}