A polymorphic engine (sometimes called mutation engine or mutating engine) is a
software component
A software component is a modular unit of software that encapsulates specific functionality. The desired characteristics of a component are reusability and maintainability.
Value
Components allow software development to assemble software ...
that uses
polymorphic code
In computing, polymorphic code is code that uses a polymorphic engine to mutate while keeping the original algorithm intact - that is, the ''code'' changes itself every time it runs, but the ''function'' of the code (its semantics) stays the sam ...
to alter the
payload
Payload is the object or the entity that is being carried by an aircraft or launch vehicle. Sometimes payload also refers to the carrying capacity of an aircraft or launch vehicle, usually measured in terms of weight. Depending on the nature of t ...
while preserving the same functionality.
Polymorphic
engines
An engine or motor is a machine designed to convert one or more forms of energy into mechanical energy.
Available energy sources include potential energy (e.g. energy of the Earth's gravitational field as exploited in hydroelectric power gen ...
are used almost exclusively in
malware
Malware (a portmanteau of ''malicious software'')Tahir, R. (2018)A study on malware and malware detection techniques . ''International Journal of Education and Management Engineering'', ''8''(2), 20. is any software intentionally designed to caus ...
, with the purpose of being harder for
antivirus software
Antivirus software (abbreviated to AV software), also known as anti-malware, is a computer program used to prevent, detect, and remove malware.
Antivirus software was originally developed to detect and remove computer viruses, hence the name ...
to detect. They do so either by
encrypting
In cryptography, encryption (more specifically, encoding) is the process of transforming information in a way that, ideally, only authorized parties can decode. This process converts the original representation of the information, known as plain ...
or
obfuscating the malware payload.
One common deployment is a
file binder
File binders are utility software that allow a user to "bind" multiple files together, resulting in a single executable. They are commonly used by Hacker (computer security), hackers to insert other programs such as Trojan horse (computing), Troja ...
that weaves malware into normal
files
File or filing may refer to:
Mechanical tools and processes
* File (tool), a tool used to remove fine amounts of material from a workpiece.
**Filing (metalworking), a material removal process in manufacturing
** Nail file, a tool used to gentl ...
, such as office documents. Since this type of malware is usually polymorphic, it is also known as a ''
polymorphic packer
File binders are utility software that allow a user to "bind" multiple files together, resulting in a single executable. They are commonly used by hackers to insert other programs such as Trojan horses into otherwise harmless files, making them ...
''.
The engine of the
Virut
Virut is a cybercrime malware botnet, operating at least since 2006, and one of the major botnets and malware distributors on the Internet. In January 2013, its operations were disrupted by the Polish organization Naukowa i Akademicka Sieć Komput ...
botnet
A botnet is a group of Internet-connected devices, each of which runs one or more Internet bot, bots. Botnets can be used to perform distributed denial-of-service attack, distributed denial-of-service (DDoS) attacks, steal data, send Spamming, sp ...
is an example of a polymorphic engine.
References
{{DEFAULTSORT:Polymorphic Engine
Types of malware