Metamorphic Virus

A metamorphic virus is a self-replicating program that does not just hide its code, it changes it. Each new copy is produced by a built-in engine that rewrites the instructions, so the copies share behavior but almost no byte patterns. That is the whole point: classic antivirus recognizes malware by what it looks like, and a metamorphic virus never looks the same twice.

What it does once it runs is a separate question. The mutation engine is only the disguise, and the payload can be anything from file infection to a keylogger or a quiet channel for data exfiltration. A useful way to think about it: the engine decides whether you can recognize the program, the payload decides what it costs you.

The mutation happens in a cycle that the virus carries inside itself, with no outside help.

1. 1

   Read its own code

   The engine disassembles the virus body into a list of instructions it can understand and edit.

2. 2

   Transform

   It applies rewrite rules, such as swapping an instruction for an equivalent one, reordering independent blocks or inserting harmless filler.

3. 3

   Rebuild

   It reassembles the changed instructions into a new, working body with fresh addresses and jumps.

4. 4

   Infect and repeat

   The new copy is attached to a target and, when it runs, starts the same cycle again.

The two are often confused. A polymorphic virus keeps the same core code and changes only its wrapper, usually an encryption layer with a different key each time. Once the wrapper is removed, the same body appears, which gives analysts something stable to match. A metamorphic virus has no stable body to find.

Metamorphic engines combine a small set of transformations. None is advanced alone, and the effect comes from stacking them across generations.

• Instruction substitution: replacing an instruction with a different one that gives the same result.
• Code reordering: shuffling blocks that do not depend on each other and fixing the jumps between them.
• Register renaming: using different processor registers for the same operations.
• Junk code insertion: adding instructions that do nothing, such as no-ops or operations that cancel out.
• Expansion and shrinking: replacing a short sequence with a longer equivalent, or the reverse.

Signature scanning compares a file with byte patterns taken from known samples. Metamorphism attacks that assumption directly, because a new variant carries no pattern that was ever recorded. Detection therefore moves from what the file looks like to what it does.

A related layer is file integrity monitoring. It does not recognize the virus at all: it notices that a protected file changed when nobody authorized a change, which works whatever the code looks like.

Because no single check recognizes every variant, defense is built from layers that fail in different ways. Behavior-based endpoint protection, application allow-listing, and timely patching reduce the chance of infection. Most infections still begin with a person, through a message such as clone phishing or a file from removable media, so mail filtering and device rules matter as much as the scanner.

Assume that one variant will eventually run. Network segmentation, least-privilege accounts, and tested backups limit what it can touch and how long the cleanup takes.

Start by asking what a successful infection could reach, not how to catch every variant. Inventory the endpoints that hold sensitive data, turn on behavior-based detection there and make sure unusual file changes and outgoing transfers get noticed.

The last line of defense is the data itself. An endpoint DLP control, such as Anexet DLP, watches the channels data leaves through, so a leak can be stopped even when the program that started it was never recognized.