Where does mutation engine resides in Metamorphic \polymorphic viruses?

Question

I was reading about Metamorphic & polymorphic viruses ..

to what i understood ; they both uses mutation engines to avoid detection by anti-viruses, as the polymorphic encrypts\decrypts its code , and the metamorphic generates a logical equivalent code.

According to what i know , viruses are parasitic male-ware. i.e. it needs a host to produce copies of itself and cannot act independently like worms .

So my question is , during the virus's typical life cycle (infection - duplications- activating payload- etc ) , where is the mutation engine in all this ? And when a virus moves from its host to another PC what happens to the engine ? And what happens at the next host in the first cycle , how can it achieve its mutation ?

Answer 1

The mutation engine is contained in the virus body.

It is just another module of the virus. Viruses typically have a file scanning module, an infection module, a mutation module, a payload module and many others. On infection, the mutation module is used to mutate all of its modules and pass them to the infected host.

Mutation engines are mostly targeted by antivirus engines because they have typical behavior and are often used for multiple families of infector malware. They are targeted also because they are weekly mutated. That is because "mutating" the "mutator" can lead to bad "monster mutations" :)

Answer 2

I think things become a little more complex...As today every hosts hold sufficiently memory to let a big, very big virus install without making a big print on host's memory: While a server could work normally with 24Gb memory how mutch could use a virus before it will be statistically visible?

There is now enough space to hold a full C compiler, analytic engines and lot of packages, like upgrade engines (same as apt-get could do in Debian, for sample). Installed virus may now be upgraded to follow anti-virus developments and have appropriate reaction...

I think, (but don't have any proof ;), that new generation of polymorphic viruses could grown and become self-versonized by himself... (and maybe through some hidden repositories for authoritative upgrades).

Nota: Bandwidth are growing too, so with the help of a little of stegano (another package in virus installation) making upgrade could be strongly hidden too.

But... I'm (a little) paranoid and have a lot of imagination.