Phorpiex is a worm which spreads via removable drives and network drives. Some Phorpiex variants will also download additional malware such as cryptominer and execute them.
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
Check for the latest database updates
First check if your F-Secure security program is using the latest detection database updates, then try scanning the file again.
Submit a sample
After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.
NOTE If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
Exclude a file from further scanning
If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.
Note You need administrative rights to change the settings.
Phorpiex typically propagates or spreads via an infected removable or shared drive. It can also spread via drive-by downloads if it infects a web server.
Upon execution, Phorpiex checks for the presence of a virtual or debugging environment; if found, it will terminate itself.
If it does not find a debugging environment, it will proceed to add a registry key so that it can persistance on the machine. It will also added a mutex to ensure that only one instance of itself is running. Different variants will have different mutexes, but all use a hardcoded 13-digit numerical value.
Next, Phorpiex starts infecting removable and shared drives. Subsequently, it also tries to connects to malicious command and control (C&C) servers to download additonal malware to be executed.
The worm is also capable of compromising system security by disabling security features.
Once it is present on a computer, the worm can propagate or spread copies of its malicious file by infecting any accessible network drives or inserted removable storage devices. Some variants also propagate by compromising web servers, which could expose site visitors to drive-by downloads.
To propagate, Phorpiex performs the following actions:
Depending on the execution privilege, Phorpiex creates a copy of itself at:
Phorpiex will also drop these file on the infected system:
Phorpiex adds the following registry key so that it can automatically run at startup:
Depending on the execution privilage:
It connects to one of the following servers, with URLs that are defined by a list of provided top-level domains (TLDs) and parameters:
The [TLD] for the server URLs may be:
The URL parameters may be:
The User-Agent is:
The worm also has the capability to:
Analysis on file: b6ce47cc2a6dbf7309957cdfd3faf8a0ba3c2c8d
Date Created: -
Date Last Modified: -