Polymorphic malware is malicious software that constantly changes its code or encryption with each copy or infection, so that every sample looks different while its behaviour stays the same.
How polymorphic malware works
A polymorphic program typically consists of an encrypted malicious body and a small decryptor. Each time it spreads, a mutation engine re-encrypts the body with a new key and rewrites the decryptor using different instructions, registers and junk code. The result is a new file hash and byte pattern for every copy. Related approaches include:
- Metamorphic malware – rewrites its entire code, not just the decryptor, so there is no constant encrypted body.
- Server-side polymorphism – the distribution server generates a freshly packed file for every download, as seen with the Storm Worm in 2007 and many modern malware campaigns.
Polymorphism is an advanced form of obfuscation. The idea is old: the 1260 virus (1990) is considered the first polymorphic virus, and the Dark Avenger Mutation Engine of the early 1990s let other virus writers add polymorphism to their creations.
Why polymorphic malware matters
Classic signature-based detection looks for known byte sequences or file hashes. When every sample is unique, a signature written for one file does not match the next, and hash-based blocklists become nearly useless. Today most widespread malware – from email-borne loaders to ransomware – uses some form of polymorphism or automated repacking.
How to detect polymorphic malware
- Rely on behavioural analysis: the actions malware performs stay the same even when its code changes.
- Use emulation and heuristic analysis to let the decryptor run and inspect the unpacked code in memory.
- Write YARA rules for stable features of the unpacked payload rather than for the outer file.
- Combine EDR telemetry with machine-learning classifiers trained on file structure.
