{
  "family": "yuner",
  "sample_count": 32,
  "category": "file_infector",
  "description": "Yuner (documented in threat intelligence research and antivirus catalogs under Virus:Win32/Yuner, Worm:Win32/Yuner, and W32/Yuner) is a landmark polymorphic file-infecting virus and worm that originated in China in 2009. Engineered for aggressive lateral spread, Yuner systematically scans local hard drives, network shares, and removable USB drives for Portable Executable (PE) files. It infects host executables by appending its polymorphic decryptor stub to the last section of legitimate PE files, redirecting the address of entry point (OEP) to execute the viral body before transferring control back to the host program. In addition to parasitic file infection, Yuner creates autorun.inf files on removable media, connects to remote IRC/HTTP servers for distributed denial-of-service (DDoS) commands, and terminates antivirus software processes to maintain persistent dominance over infected systems.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Virus:Win32/Yuner",
    "Worm:Win32/Yuner",
    "Virus.Win32.Yuner",
    "Win32/Yuner",
    "W32/Yuner",
    "Virus:Win32/Yuner.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Virus:Win32/Yuner?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yuner is a polymorphic file-infecting virus and worm that appends malicious code to Windows PE executables and spreads across USB drives and network shares."
      }
    },
    {
      "@type": "Question",
      "name": "How does Yuner infect executable files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It appends its polymorphic code to the last section of host PE files and redirects the initial entry point to run the virus before host application execution."
      }
    },
    {
      "@type": "Question",
      "name": "How does Yuner spread to external systems?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It copies itself to removable USB flash drives alongside an autorun.inf file and scans local networks for open, writable SMB shares."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary botnet capabilities does Yuner possess?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yuner connects to remote command-and-control servers to participate in coordinated distributed denial-of-service (DDoS) flooding attacks."
      }
    },
    {
      "@type": "Question",
      "name": "How can infected PE files be cleaned without corrupting host programs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Use specialized antivirus disinfection utilities that strip the appended section and restore the original entry point (OEP), or restore clean files from backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1091",
    "T1080",
    "T1562.001",
    "T1498",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2009,
  "threat_actor": null,
  "delivery_mechanism": [
    "Parasitic PE File Infection",
    "Removable USB Drives (Autorun.inf)",
    "Writable SMB Network Shares"
  ],
  "target_platforms": [
    "Windows 7",
    "Windows Vista",
    "Windows XP",
    "Windows Server 2003",
    "Windows 2000"
  ],
  "capabilities": [
    "Parasitic PE Header Appending Infection",
    "Polymorphic Decryption Engine",
    "Removable Drive Autorun Propagation",
    "Local Network Share Traversal",
    "DDoS Flood Attack Capabilities"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Polymorphic Virus)",
      "Infected Host Executable"
    ],
    "network_signatures": [
      "High-volume UDP/TCP flood traffic directed toward designated target IP addresses during DDoS activations",
      "Outbound IRC or HTTP beaconing to remote C2 channels to receive infection and update commands"
    ],
    "evasion_techniques": [
      "Polymorphic encryption generator altering the decryptor stub opcodes across every newly infected host binary",
      "Killing processes belonging to major antivirus and personal firewall security products"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a",
      "8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b"
    ],
    "registry_keys": [
      "HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\YunerService",
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\Folder\\Hidden\\SHOWALL"
    ],
    "file_paths": [
      "%SystemRoot%\\System32\\yuner.exe",
      "%Drive%\\autorun.inf",
      "%SystemRoot%\\system32\\drivers\\yuner.sys"
    ]
  },
  "defensive_measures": [
    "Disable Windows AutoRun / AutoPlay functionality enterprise-wide via Group Policy",
    "Deploy endpoint security with advanced disinfection engines capable of restoring appended PE headers",
    "Restrict write access to administrative network shares across internal subnets"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Virus:Win32/Yuner.A",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Virus:Win32/Yuner.A"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Virus.Win32.Yuner",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    },
    {
      "name": "Kaspersky Securelist - Virus.Win32.Yuner In-Depth",
      "url": "https://securelist.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Virus:Win32/Yuner.A",
      "Virus:Win32/Yuner.B",
      "Worm:Win32/Yuner.gen"
    ]
  },
  "motivation": "Aggressive File Infection, Worm Propagation & Botnet Recruitment",
  "sample_hashes": []
}