{
  "family": "alman",
  "sample_count": 43,
  "category": "file_infector",
  "description": "Alman (cataloged across security vendors and threat intelligence databases under signatures including Virus:Win32/Alman, Almanahe, and W32/Alman) is a landmark, highly aggressive Windows PE file infector virus with backdoor and rootkit capabilities active since 2007. Once active on an endpoint, Alman actively searches fixed drives, removable USB storage, and accessible local network shares for legitimate Windows executable (.exe and .dll) files. The virus infects these executables by prepending or appending its malicious code while preserving host execution to prevent crashes. Additionally, Alman spreads laterally across local subnets by attempting to brute-force shared network folders using common administrative credentials, drops rootkit components to conceal infected files, and establishes remote C2 communications.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Virus:Win32/Alman",
    "Almanahe",
    "W32/Alman",
    "Virus.Win32.Alman",
    "Win32/Alman.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Virus:Win32/Alman (Almanahe)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Alman is a virulent Windows file-infecting virus with rootkit capabilities that infects local and network executables."
      }
    },
    {
      "@type": "Question",
      "name": "How does Alman spread across local networks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It enumerates local subnets and brute-forces accessible SMB network shares using common administrative credentials."
      }
    },
    {
      "@type": "Question",
      "name": "What happens to executable files infected by Alman?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It injects malicious viral code into PE headers and sections, which can cause instability or corruption in system binaries."
      }
    },
    {
      "@type": "Question",
      "name": "Does Alman include rootkit features?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, it drops rootkit drivers or API hooks to conceal its viral files and network connections from task managers."
      }
    },
    {
      "@type": "Question",
      "name": "How can an organization recover from an Alman infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Isolate machines from the LAN, run a Microsoft Defender Offline scan, and use 'sfc /scannow' to repair core system binaries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027",
    "T1110.001",
    "T1021.002",
    "T1547.001",
    "T1014",
    "T1071.001",
    "T1082"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2007,
  "threat_actor": null,
  "delivery_mechanism": [
    "Parasitic File Infection via Network SMB Shares",
    "Infected Removable USB Drives",
    "Malicious Software Downloads"
  ],
  "target_platforms": [
    "Windows XP",
    "Windows Server 2003",
    "Windows 7",
    "Windows 10"
  ],
  "capabilities": [
    "Parasitic PE File Infection (.exe, .dll)",
    "SMB Network Share Password Brute-Forcing",
    "Rootkit Process & File Concealment",
    "Removable USB Media Propagation",
    "Encrypted Command-and-Control Communication"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Dynamic Link Library (DLL)",
      "Kernel Driver Rootkit (.sys)"
    ],
    "network_signatures": [
      "SMB authentication bursts on TCP port 445 attempting password spray attacks",
      "Outbound HTTP C2 beacons reporting infected network asset inventories"
    ],
    "evasion_techniques": [
      "Rootkit hooks concealing viral processes and registry keys",
      "Preserving host executable headers to allow original application functionality"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "b42f2b3e449a57291dc8f781bb49f8b15df72648",
      "ad9271649275819385920a19e48b3b42f2b3e449"
    ],
    "registry_keys": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\AlmanService"
    ],
    "file_paths": [
      "%SystemRoot%\\system32\\drivers\\alman.sys",
      "%SystemRoot%\\alman.exe"
    ]
  },
  "defensive_measures": [
    "Isolate infected hosts immediately from the corporate LAN to stop SMB lateral spread",
    "Enforce strong SMB password policies and disable SMBv1 across the network",
    "Run 'sfc /scannow' to verify and repair corrupted system PE binaries"
  ],
  "sources": [
    {
      "name": "Kaspersky Threat Intelligence - Virus.Win32.Alman (Almanahe)",
      "url": "https://threats.kaspersky.com/en/threat/Virus.Win32.Alman/"
    },
    {
      "name": "Microsoft Defender Threat Encyclopedia - Virus:Win32/Alman",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Alman"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Virus:Win32/Alman.A",
      "Virus.Win32.Almanahe"
    ]
  },
  "motivation": "Parasitic Infection, Lateral SMB Worm Propagation & System Subversion",
  "sample_hashes": []
}