CyberGlossary

Malware

Metamorphic Malware

Also known as: Self-rewriting malware, Code-morphing malware

Definition

Malware that fully rewrites its own code on each propagation, producing semantically equivalent but structurally different binaries.

Metamorphic malware goes beyond polymorphism by recompiling or transforming the entire payload — not just an outer encryption layer — for each new infection. Engines apply techniques such as instruction substitution, register renaming, control-flow flattening, code transposition and dead-code insertion, so two infected samples may share no common byte sequence yet behave identically. This makes static signature detection nearly useless and forces defenders to rely on dynamic analysis, semantic similarity, behavioural EDR and emulation-based scanners. Metamorphic engines are rare in commodity malware due to their complexity but appear in academic research, advanced viruses and some targeted toolkits.

Examples

  • W32/Simile (Etap), a research-grade metamorphic virus.
  • ZMist (Zmorph) by Z0mbie, an early demonstration of code transposition.

Related terms