{
  "family": "xorer",
  "sample_count": 25,
  "category": "worm",
  "description": "Xorer (cataloged across security intelligence feeds under signatures including Virus:Win32/Xorer, Worm:Win32/Xorer, and Trojan.Xorer) is a notorious polymorphic Windows PE file infector and network worm active since 2006. Originating in East Asia, Xorer combines aggressive file infection with automated worm propagation over removable USB drives and local network shares. Upon execution, Xorer terminates endpoint security processes, hooks native file access APIs, and injects viral decryptor routines into 32-bit PE executable files across all mounted drives. Furthermore, it creates hidden autorun.inf files on flash drives, disables Windows Safe Mode, prevents access to the Registry Editor and Task Manager, and establishes encrypted backdoor connections to remote C2 servers.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Virus:Win32/Xorer",
    "Worm:Win32/Xorer",
    "Trojan.Xorer",
    "Win32/Xorer",
    "Xorer.worm"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Virus:Win32/Xorer?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Xorer is a destructive polymorphic file-infecting worm that corrupts PE executables and spreads via USB flash drives and network shares."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xorer infect executable files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It traverses local and network drives, appending polymorphic encrypted shellcode to 32-bit PE binaries and redirecting the entry point."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xorer spread across removable media?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It copies hidden executable files to USB drives alongside an autorun.inf configuration to trigger execution when inserted."
      }
    },
    {
      "@type": "Question",
      "name": "How does Xorer impair Windows security tools?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It modifies registry policies to disable Task Manager and Regedit, terminates antivirus processes, and disables Safe Mode booting."
      }
    },
    {
      "@type": "Question",
      "name": "How can an enterprise remediate a Xorer outbreak?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Boot from offline recovery media, run specialized antimalware disinfectors to repair infected PE binaries, and restore corrupted system files."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1055.001",
    "T1091",
    "T1562.001",
    "T1112",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2006,
  "threat_actor": null,
  "delivery_mechanism": [
    "Infected Removable USB Drives (AutoRun)",
    "Network Share Worm Propagation",
    "Trojanized Software Keygens"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows XP",
    "Windows Server"
  ],
  "capabilities": [
    "Polymorphic PE File Infection & Header Modification",
    "USB Flash Drive AutoRun Worm Spreading",
    "Task Manager & Registry Tools Disablement",
    "Antivirus Process Termination",
    "Backdoor Remote Command Execution"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Infected Host)",
      "AutoRun Configuration File (autorun.inf)"
    ],
    "network_signatures": [
      "Encrypted TCP beacons communicating with remote IP addresses reporting host infection statistics",
      "Periodic scanning across local subnet port 445 (SMB) for accessible shared folders"
    ],
    "evasion_techniques": [
      "Generating unique polymorphic decryptor stubs for every infected executable on the host",
      "Modifying file system permissions to protect infected binaries from deletion"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "15d0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8",
      "26e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableRegistryTools"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\xorer.exe",
      "%Temp%\\xorer_hook.dll"
    ]
  },
  "defensive_measures": [
    "Disable USB AutoPlay and AutoRun across all Windows workstations via Group Policy",
    "Enforce application control and file integrity monitoring (FIM) to detect unauthorized PE header modifications",
    "Deploy endpoint behavioral protection to block unauthorized modification of Task Manager registry policies"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Virus:Win32/Xorer",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Xorer"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - PE_XORER",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Virus:Win32/Xorer.A",
      "Virus:Win32/Xorer.B"
    ]
  },
  "motivation": "Network Disruption, Host Compromise & Binary Corruption",
  "sample_hashes": []
}