{
  "family": "cia",
  "sample_count": 12,
  "category": "file_infector",
  "description": "The CIA virus is a classic DOS-based file infector that primarily targets .COM and .EXE executables. Emerging in the early era of PC viruses, it employs memory-resident techniques to intercept DOS interrupts, allowing it to silently append its viral payload to uninfected host files upon execution or file access. The virus often utilizes basic polymorphic or encryption routines to evade primitive signature-based detection mechanisms common during its time. Once resident in memory, it monitors file operations and seamlessly infects clean files, which contributes to a rapid but stealthy propagation within local systems. Although largely obsolete in modern operating environments due to the transition away from MS-DOS architecture, analyzing the CIA virus provides foundational insights into the evolution of memory residency, interrupt hooking (specifically INT 21h), and parasitic file infection strategies that later evolved into more sophisticated rootkits and bootkits.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "DOS.CIA",
    "CIA.Virus"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the CIA malware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It is a legacy DOS file infector that targets COM and EXE files by appending its viral code."
      }
    },
    {
      "@type": "Question",
      "name": "How does it infect files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It intercepts DOS interrupts (like INT 21h) to monitor file access and injects its payload when executables are run."
      }
    },
    {
      "@type": "Question",
      "name": "Is it still a threat today?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, it relies on the MS-DOS architecture, which is largely unsupported on modern operating systems."
      }
    },
    {
      "@type": "Question",
      "name": "How is it detected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Legacy antivirus scanners detect it via signature matching or heuristic analysis of DOS executables."
      }
    },
    {
      "@type": "Question",
      "name": "What category of malware is it?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It falls under the file infector or parasitic virus category."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055",
    "T1562.001"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1562.001",
      "name": "Impair Defenses: Disable or Modify Tools",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Cia binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Cia installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Symantec Security Response - W95.CIA Virus Analysis",
      "url": "https://support.broadcom.com"
    },
    {
      "name": "Kaspersky Virus Encyclopedia - Virus.Win32.CIA",
      "url": "https://securelist.com"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "high",
  "first_seen": 2000,
  "motivation": "Disruption",
  "threat_actors": [
    "Unknown / Virus Author"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "lineage": {
    "derived_from": [
      "pe_entrypoint_hijacker_virus"
    ],
    "variants": [
      "w95.cia",
      "win32.cia.4096"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-EFA",
    "D3-SDA"
  ],
  "cve": [
    "CVE-2000-0222",
    "CVE-2001-0500"
  ],
  "iocs": {
    "file_hashes": [
      "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4",
      "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5"
    ],
    "delivery": [
      "Infected portable executable (.EXE) file transfer across local networks and storage media",
      "File-sharing network distribution of patched utility binaries"
    ],
    "persistence": [
      "PE header entry point hijacking across host executable files in %System32%",
      "Infection of standard Windows Explorer executables upon file enumeration"
    ]
  },
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}