{
  "family": "invader",
  "sample_count": 27,
  "category": "file_infector",
  "description": "Invader (cataloged in antimalware repositories under signatures including Virus:Win32/Invader, Trojan:Win32/Invader, and Virus.Win32.Invader) is a sophisticated parasitic Windows PE file infector and memory-resident rootkit active since 2005. Once executed on a target machine, Invader injects a thread into the Windows kernel space or core system processes (services.exe, svchost.exe), hooking native file system APIs. Invader traverses local and mapped drives, searching for 32-bit Portable Executable (.exe) files. It prepends or appends polymorphic decryption routines to host binaries while relocating the original entry point (OEP), ensuring execution of its viral payload prior to passing control to the legitimate program. Invader disables system security notifications and blocks access to antivirus vendor update domains.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Virus:Win32/Invader",
    "Trojan:Win32/Invader",
    "Virus.Win32.Invader",
    "Win32/Invader",
    "W32/Invader.virus"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Virus:Win32/Invader?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Invader is a parasitic Windows file infector that injects malicious code into PE executables and hooks system processes in memory."
      }
    },
    {
      "@type": "Question",
      "name": "How does Invader infect executable files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies the headers of target 32-bit PE executables, redirecting the Original Entry Point (OEP) to its polymorphic viral decryptor."
      }
    },
    {
      "@type": "Question",
      "name": "How does Invader maintain persistence on infected systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Because it infects existing legitimate Windows executables, it automatically executes whenever infected system or third-party applications run."
      }
    },
    {
      "@type": "Question",
      "name": "How does Invader defend against antivirus software?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies the local hosts file to block connections to antimalware update servers and terminates security scanner processes."
      }
    },
    {
      "@type": "Question",
      "name": "How can an enterprise clean an Invader infection?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot into a clean Windows PE / offline recovery environment and use dedicated file disinfectors or restore clean system backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.001",
    "T1547.001",
    "T1562.001",
    "T1082",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2005,
  "threat_actor": null,
  "delivery_mechanism": [
    "Infected Executable File Sharing",
    "P2P Network Downloads",
    "Removable USB Media Propagation"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ],
  "capabilities": [
    "Parasitic PE Header Modification & OEP Hijacking",
    "Process Injection into svchost.exe & services.exe",
    "Hosts File DNS Redirection for AV Update Blocking",
    "Local & Network Share Executable Infection",
    "Polymorphic Engine Decryption"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Infected Host)",
      "Memory Injection Shellcode"
    ],
    "network_signatures": [
      "Attempts to contact remote C2 endpoints while dropping localized DNS resolution for common AV domains in the hosts file",
      "Periodic TCP beacons checking for internet connectivity"
    ],
    "evasion_techniques": [
      "Polymorphic code generation generating unique decryptor stubs for every infected executable",
      "Hooking file access APIs to conceal viral section expansion in infected files"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3",
      "26c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4"
    ],
    "registry_keys": [
      "HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\InvaderHook",
      "HKLM\\SYSTEM\\CurrentControlSet\\Services\\InvaderDrv"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\drivers\\etc\\hosts",
      "%Temp%\\invader_hook.dll"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint file integrity monitoring (FIM) to detect unauthorized PE header modifications",
    "Lock down write permissions on Windows System32 and Program Files directories",
    "Use application whitelisting and code signing enforcement (WDAC) to prevent running modified binaries"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Virus:Win32/Invader",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Invader"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PE_INVADER",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Virus:Win32/Invader.A",
      "Virus:Win32/Invader.B"
    ]
  },
  "motivation": "System Disruption, Binary Corruption & Persistent Host Control",
  "sample_hashes": []
}