Threat Descriptions

Worm:W32/Phorpiex

Classification

Category :

Malware

Type :

Worm

Platform :

W32

Aliases :

TR/AD.Phorpiex.sdjto

Summary

Phorpiex is a worm which spreads via removable drives and network drives. Some Phorpiex variants will also download additional malware such as cryptominer and execute them.

Removal

Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.

A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:

  • Check for the latest database updates

    First check if your F-Secure security program is using the latest updates, then try scanning the file again.

  • Submit a sample

    After checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.

    Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.

  • Exclude a file from further scanning

    If you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.

    Note: You need administrative rights to change the settings.

Technical Details

Infection Vector

 Phorpiex typically propagates or spreads via an infected removable or shared drive. It can also spread via drive-by downloads if it infects a web server.

Behavior

 Upon execution, Phorpiex checks for the presence of a virtual or debugging environment; if found, it will terminate itself.

 If it does not find a debugging environment, it will proceed to add a registry key so that it can persistance on the machine. It will also added a mutex to ensure that only one instance of itself is running. Different variants will have different mutexes, but all use a hardcoded 13-digit numerical value.

 Next, Phorpiex starts infecting removable and shared drives. Subsequently, it also tries to connects to malicious command and control (C&C) servers to download additonal malware to be executed.

 The worm is also capable of compromising system security by disabling security features.

Propagation

 Once it is present on a computer, the worm can propagate or spread copies of its malicious file by infecting any accessible network drives or inserted removable storage devices. Some variants also propagate by compromising web servers, which could expose site visitors to drive-by downloads.

 To propagate, Phorpiex performs the following actions:

  1. Identifies any available removable device(s) using Windows API GetLogicalDriveStringW and GetDriveType.
  2. On the removable device, it creates a new folder (with hidden and system attributes) and copies itself to the folder.
  3. Creates an Autorun.inf file to execute the copy in the hidden folder.
  4. Enumerates all folders and files within the root directory:
    1. Moves all folders and files into the newly created folder.
    2. It deletes these specific file types.
      • .lnk, .vbs, .js, .scr, .com, .jse, .cmd, .pif, .jar, .dll
    3. Creates a shortcut and target path for the device:
      • Target name: [drive_name].lnk
      • Target path: %windir%\system32\cmd.exe /c start [worm_copied_file] & exit

Files created

 Depending on the execution privilege, Phorpiex creates a copy of itself at:

  • %windir%\5060077904302040\winsvcs.exe
  • %userprofile%\5060077904302040\winsvcs.exe
  • %appdata%\5060077904302040\winsvcs.exe or
  • %temp%\5060077904302040\winsvcs.exe

Phorpiex will also drop these file on the infected system:

  • %temp%\5060077904302040\Windows Archive Manager.exe
  • %appdata%\winsvcs_.txt

Registry Changes

Phorpiex adds the following registry key so that it can automatically run at startup:

Depending on the execution privilage:

  • "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ : [path of the newly copied file of itself]\5060077904302040\winsvcs.exe"
  • "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ : [path of the newly copied file of itself]\5060077904302040\winsvcs.exe"

Network activity

It connects to one of the following servers, with URLs that are defined by a list of provided top-level domains (TLDs) and parameters:

  • hxxp://92.63[.]197.48/
  • hxxp://afeifieuuufufufuf.[TLD]
  • hxxp://aiiaiafrzrueuedur.[TLD]
  • hxxp://eiifngjfksisiufjf.[TLD]
  • hxxp://eofihsishihiursgu.[TLD]
  • hxxp://eoroooskfogihisrg.[TLD]
  • hxxp://fifiehsueuufidhfi.[TLD]
  • hxxp://fiiauediehduefuge.[TLD]
  • hxxp://fuaiuebndieufeufu.[TLD]
  • hxxp://iuirshriuisruruuf.[TLD]
  • hxxp://nnososoosjfeuhueu.[TLD]
  • hxxp://noeuaoenriusfiruu.[TLD]
  • hxxp://nousiieiffgogogoo.[TLD]
  • hxxp://slpsrgpsrhojifdij.[TLD]
  • hxxp://srndndubsbsifurfd.[TLD]
  • hxxp://ssofhoseuegsgrfnu.[TLD]

The [TLD] for the server URLs may be:

  • .biz, .com, .in, .info, .net, .su, .ru

The URL parameters may be:

  • /m.exe, /o.exe, /p.exe, /s.exe, /t.exe, /tldr.php?new=1, /tldr.php?on=1

The User-Agent is:

  • Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0

Other Behavior

The worm also has the capability to:

  1. Check for the presence of a virtual environment by checking running processes against the following list of common virtualization software:
    • prl_cc.exe, prl_tools.exe, vmsrvc.exe, vmusrvc.exe, xenservice.exe, vboxservice.exe, vboxtray.exe, vboxcontrol.exe, vmwareservice.exe, vmwaretray.exe, tpautoconnsvc.exe, vmtoolsd.exe, vmwareuser.exe, python.exe, pythonw.exe.
  2. Checks if its being debugged or being subjected to 'anti-sandboxing' by checking if the following DLLs exist:
    • sbiedll.dll, sbiedllx.dll, dir_watch.dll, wpespy.dll, wine_get_unix_file_name.

Analysis on file: b6ce47cc2a6dbf7309957cdfd3faf8a0ba3c2c8d