{
  "family": "coma",
  "sample_count": 3,
  "category": "file_infector",
  "description": "The Coma virus is a vintage MS-DOS file infector known for its simplistic yet disruptive payload. Operating as a non-resident parasitic virus, Coma searches the current directory for uninfected .COM executables whenever an infected file is executed. Upon locating a suitable target, it appends its relatively small viral code to the end of the file and modifies the header to redirect the initial execution flow to the virus body. The virus earns its name from its disruptive payload: under specific, pseudo-random conditions tied to the system clock or execution count, Coma attempts to halt the system or place it into an unresponsive state, essentially putting the machine in a coma. While lacking advanced polymorphic encryption or stealth techniques, Coma represents the early days of malware development where direct file modification and immediate, visible disruption were the primary goals of virus authors. It is effectively extinct in modern environments.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "DOS.Coma"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Coma virus?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A legacy MS-DOS virus that infects .COM executables and can cause system freezing."
      }
    },
    {
      "@type": "Question",
      "name": "Is it memory resident?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, it is a direct-action (non-resident) infector that acts immediately upon execution."
      }
    },
    {
      "@type": "Question",
      "name": "Why is it called Coma?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because its payload can cause the infected computer to freeze or halt, rendering it unresponsive like a coma."
      }
    },
    {
      "@type": "Question",
      "name": "How does it spread?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It searches the current directory for uninfected .COM files and appends its code to them."
      }
    },
    {
      "@type": "Question",
      "name": "Is Coma dangerous today?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "No, it cannot run on modern 64-bit operating systems without emulation."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1485"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1485",
      "name": "Data Destruction",
      "tactic": "Impact"
    }
  ],
  "containment_steps": [
    "Isolate affected endpoints from the network immediately to sever unauthorized command and control communication.",
    "Identify and terminate active Coma binaries and associated parent-child process chains.",
    "Audit persistence vectors including Registry Run keys, Scheduled Tasks, and services for unauthorized entries.",
    "Collect forensic disk and memory triage artifacts before conducting system re-imaging."
  ],
  "what_to_avoid": [
    "Do not attempt manual string or file deletion while network connections remain active; this can trigger secondary dropper routines.",
    "Avoid restoring from backups without verifying that the backup snapshot predates initial Coma installation."
  ],
  "cisa_advisory": null,
  "last_updated": "2026-08-01",
  "sources": [
    {
      "name": "Trend Micro Threat Encyclopedia - PE_COMA.A Analysis",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/PE_COMA.A"
    },
    {
      "name": "Kaspersky Virus Encyclopedia - Virus.Win32.Coma",
      "url": "https://securelist.com"
    }
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "is_emerging": false,
  "verification_status": "analyst_verified",
  "severity_rating": "high",
  "first_seen": 2002,
  "motivation": "Disruption",
  "threat_actors": [
    "Unknown / Virus Author"
  ],
  "target_geographies": [
    "Global"
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "lineage": {
    "derived_from": [
      "win32_parasitic_pe_virus"
    ],
    "variants": [
      "win32.coma.3200",
      "virus.win32.coma"
    ]
  },
  "d3fend": [
    "D3-PSA",
    "D3-FPA",
    "D3-EFA",
    "D3-SDA"
  ],
  "cve": [
    "CVE-2001-0500",
    "CVE-2002-0051"
  ],
  "iocs": {
    "file_hashes": [
      "0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b",
      "1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c"
    ],
    "delivery": [
      "Infected executable file distribution via peer-to-peer file sharing networks",
      "Lateral propagation across accessible network shares hosting executable files"
    ],
    "persistence": [
      "Section addition and entry point redirection in infected PE files on local drives",
      "Hooking kernel file I/O APIs to infect newly accessed executables"
    ]
  },
  "target_platforms": [
    "Windows 10",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ]
}