Cyn
Table of Contents
Overview
Cyn (cataloged across classical antivirus telemetry as Virus:DOS/Cyn and Virus:Win32/Cyn) is an early parasitic file infector originally engineered for MS-DOS environments and later observed impacting legacy 16-bit and 32-bit execution layers. The virus is implemented in concise x86 assembly, attaching its replication routine directly to uninfected .COM and .EXE host binaries within the active directory and system search paths. When an infected host executable is invoked, the virus intercepts program control at the entry point, traverses local file systems to locate target executables, and splices its parasitic code into the binary header or trailing slack space before returning execution to the legitimate application logic. While Cyn does not incorporate intentional data-destructive wiping mechanisms, rudimentary error-handling and improper relocations in certain variants frequently cause binary corruption, structural header misalignment, and unexpected system crashes. Cyn represents early parasitic replication techniques and is completely mitigated by modern operating system integrity controls and signature heuristics.
Known aliases
Threat reports may refer to this family under multiple names:
Family Pedigree & Lineage
Malware authors regularly fork and iterate upon existing codebases. Observed upstream lineage and downstream variants for this family include:
Derived From / Upstream Ancestry: Generic Dos Parasitic Infector
Known Derivatives & Downstream Variants: Dos.Cyn.446 · Dos.Cyn.512
MITRE ATT&CK Techniques
Observed techniques used by this family, mapped to our technical analysis hubs and the official MITRE ATT&CK framework:
| Technique | Name | Tactic | Official Spec |
|---|---|---|---|
T1055 | Process Injection | Defense Evasion | ATT&CK ↗ |
T1027 | Obfuscated Files or Information | Defense Evasion | ATT&CK ↗ |
T1083 | File and Directory Discovery | Discovery | ATT&CK ↗ |
MITRE D3FEND™ Defensive Countermeasures
Defensive techniques mapped to counter the offensive tradecraft observed in this family (via the MITRE D3FEND matrix):
| D3FEND ID | Countermeasure Name | Tactic | Countered ATT&CK | Defensive Guidance |
|---|---|---|---|---|
D3-BDA | Binary De-obfuscation & Unpacking | Analyze | T1027 | Utilize memory dump scanners and entropy inspection to unpack encrypted stagers during process creation. |
D3-PIAD | Process Injection Analysis & Detection | Detect | T1055 | Monitor cross-process thread creation (CreateRemoteThread) and asynchronous procedure calls (QueueUserAPC). |
D3-FDA | File Directory Access Auditing | Detect | T1083 | Audit and alert on high-frequency recursive directory queries executed by non-system and unclassified binaries. |
Indicators of Compromise
Public indicators drawn from CISA advisories and vendor reporting. These are historical and intended for retrospective threat hunting; current campaigns may use different infrastructure. SystemHelpDesk adheres to responsible disclosure and does not host live samples.
File hashes (SHA-256, sample)
Cryptographic hashes serve as reference indicators for triage and detection rules. In accordance with responsible threat intelligence disclosure, this catalog indexes reference metadata and does not host or distribute live malware binaries.
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b8553a1c8f42e2b9609a5b6ef9d592655bf9eb9a9e334a974b621e25e229c15d8f63
Delivery vectors
Direct execution of infected MS-DOS .COM and .EXE host filesShared floppy disks, removable optical media, and legacy bulletin board system (BBS) software archives
Persistence mechanisms
Parasitic code injection directly modifying executable file headers and entry point vectors
Tiered Detection Rules (Cisco CAIRN Model)
Modern threat detection requires multi-layered rule engineering. We classify detections into three operational tiers based on signal fidelity:
Tier 1 Primitive Artifact Rule (Fast Triage)
Matches raw strings and file markers. Vulnerable to binary repacking and simple obfuscation.
rule MALWARE_WIN_CYN_T1_ARTIFACT {
meta:
description = "Tier 1 Primitive Artifact: Raw string matches for Cyn"
tier = "T1 - Primitive Artifact"
confidence = "Low-Medium (Fast Triage)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
$s1 = "cyn" ascii wide nocase
$s2 = "dos.cyn" ascii wide nocase
$s3 = "virus.dos.cyn.446" ascii wide nocase
$s4 = "virus:win32/cyn" ascii wide nocase
$s5 = "cyn.446" ascii wide nocase
$s6 = "cyn.512" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Tier 2 Behavioral Context Rule (Process Chains & Sigma)
Tracks parent-child process anomalies and suspicious scripting telemetry. Resilient against file renames.
title: SystemHelpDesk Detection - Cyn (File Infector) Execution & Triage
id: 3e46475e-0f38-5020-ad07-5b345fdc381f
status: production
description: Detects execution, defense evasion, and persistence behaviors associated
with the Cyn malware family. Detects suspicious execution from temporary user directories
with hidden window flags and background transfer utilities.
references:
- https://malware-families-catalog.systemhelpdesk.com/families/cyn
- https://malware-families-catalog.systemhelpdesk.com/defensive/ransomware-protection
- https://malware-families-catalog.systemhelpdesk.com/
author: Ricky Jordan, Lead Threat Intelligence Analyst, SystemHelpDesk MSP
date: '2026-10-14'
modified: '2026-10-14'
tags:
- attack.file-infector
- author.ricky-jordan
- source.systemhelpdesk-mfc
- attack.t1055
- attack.t1027
- attack.t1083
logsource:
category: process_creation
product: windows
detection:
selection_process:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \cscript.exe
- \wscript.exe
CommandLine|contains:
- AppData\Local\Temp
- -WindowStyle Hidden
- /e:jscript
- bitsadmin /transfer
condition: selection_process
falsepositives:
- Legitimate enterprise administrative scripts during approved change windows
- Authorized IT software deployment utilities and backup management agents
level: mediumTier 3 Attribution Fingerprint Rule (High Fidelity)
Deep signature matching distinctive operational fingerprints and payload characteristics.
rule MALWARE_WIN_CYN_T3_ATTRIBUTION {
meta:
description = "Tier 3 Attribution Fingerprint: Heuristic detection for Cyn tradecraft"
tier = "T3 - Attribution Fingerprint"
confidence = "High (Confirmed Family Signature)"
author = "SystemHelpdesk Threat Research Desk"
date = "2026-10-14"
strings:
// Core family identifier & heuristic payload signatures
$attrib_str = "cyn" ascii wide nocase
$pe_magic = "MZ" ascii
$net_marker = "http" ascii nocase
condition:
uint16(0) == 0x5a4d and ($attrib_str and $net_marker) and filesize < 15MB
}Containment & Response Steps
Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.
- Isolate endpoints exhibiting parasitic file modification indicators to prevent lateral traversal.
- Scan and quarantine all infected host executables (.COM, .EXE) identified by antimalware heuristics.
- Restore corrupted host executables from verified clean application installers or known-good golden image backups.
- Audit shared network drives and legacy storage devices for residual infected binary artifacts.
What to Avoid
Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.
- Do not execute unidentified legacy binary files on production endpoints without hypervisor sandbox analysis.
- Avoid running unverified executable repair tools that may truncate headers and permanently destroy valid binary sections.
References & External Analysis
- Trend Micro Threat Encyclopedia - Virus:DOS/Cyn Details
- Microsoft Defender Security Intelligence - Virus:DOS/Cyn.446
- Search "cyn" on VirusTotal (External Analysis)
- Search "cyn" on Any.Run (Sandbox Sandbox)
- Search "cyn" on MalwareBazaar (Malware Samples)
Frequently Asked Questions
What is the Cyn file infector virus?
Cyn is an early x86 parasitic file infector virus that replicates by prepending or appending its code to executable files (.COM and .EXE).
How does the Cyn virus propagate and infect executables?
When an infected program runs, Cyn scans the local directory and PATH for clean executables and splices its malicious code into host headers.
Does Cyn cause permanent data loss or file corruption?
While Cyn lacks an intentional payload wiper, flawed assembly code and relocation errors in early variants frequently corrupt infected executables.
What lineage and historical variants exist for Cyn?
Documented variants include Cyn.446 and Cyn.512, named after their respective compiled payload byte lengths in DOS environments.
Is Cyn dangerous to modern operating systems?
No. Modern 64-bit Windows architectures, DEP, ASLR, and modern endpoint security controls render 16-bit DOS parasitic viruses obsolete and inert.
How do I remove Cyn from Windows?
Manual removal of Cyn is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
What are the main symptoms of a Cyn infection?
Symptoms of Cyn can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Protect Your Network Against File_Infectors
Want to prevent Cyn and similar threats from compromising your organization? Read our comprehensive defensive guide: Think You've Been Hacked? What To Do First.
📣 Threat Intel Correction or Update?
Notice an outdated IOC, unlisted alias, or disputed attribution? Threat researchers are invited to propose an update on GitHub or contact the SystemHelpDesk research desk. All community revisions are credited in our public CHANGELOG.
Machine-readable
Get this profile as JSON: https://malware-families-catalog.systemhelpdesk.com/api/cyn.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.