Phorpiex typically propagates or spreads via an infected removable or shared drive. It can also spread via drive-by downloads if it infects a web server.
Upon execution, Phorpiex checks for the presence of a virtual or debugging environment; if found, it will terminate itself.
If it does not find a debugging environment, it will proceed to add a registry key so that it can persistance on the machine. It will also added a mutex to ensure that only one instance of itself is running. Different variants will have different mutexes, but all use a hardcoded 13-digit numerical value.
Next, Phorpiex starts infecting removable and shared drives. Subsequently, it also tries to connects to malicious command and control (C&C) servers to download additonal malware to be executed.
The worm is also capable of compromising system security by disabling security features.
Once it is present on a computer, the worm can propagate or spread copies of its malicious file by infecting any accessible network drives or inserted removable storage devices. Some variants also propagate by compromising web servers, which could expose site visitors to drive-by downloads.
To propagate, Phorpiex performs the following actions:
- Identifies any available removable device(s) using Windows API GetLogicalDriveStringW and GetDriveType.
- On the removable device, it creates a new folder (with hidden and system attributes) and copies itself to the folder.
- Creates an Autorun.inf file to execute the copy in the hidden folder.
- Enumerates all folders and files within the root directory:
- Moves all folders and files into the newly created folder.
- It deletes these specific file types.
- .lnk, .vbs, .js, .scr, .com, .jse, .cmd, .pif, .jar, .dll
- Creates a shortcut and target path for the device:
- Target name: [drive_name].lnk
- Target path: %windir%\system32\cmd.exe /c start [worm_copied_file] & exit
Depending on the execution privilege, Phorpiex creates a copy of itself at:
- %appdata%\5060077904302040\winsvcs.exe or
Phorpiex will also drop these file on the infected system:
- %temp%\5060077904302040\Windows Archive Manager.exe
Phorpiex adds the following registry key so that it can automatically run at startup:
Depending on the execution privilage:
- "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ : [path of the newly copied file of itself]\5060077904302040\winsvcs.exe"
- "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ : [path of the newly copied file of itself]\5060077904302040\winsvcs.exe"
It connects to one of the following servers, with URLs that are defined by a list of provided top-level domains (TLDs) and parameters:
The [TLD] for the server URLs may be:
- .biz, .com, .in, .info, .net, .su, .ru
The URL parameters may be:
- /m.exe, /o.exe, /p.exe, /s.exe, /t.exe, /tldr.php?new=1, /tldr.php?on=1
The User-Agent is:
- Mozilla/5.0 (Macintosh; Intel Mac OS X 10.9; rv:25.0) Gecko/20100101 Firefox/25.0
The worm also has the capability to:
- Check for the presence of a virtual environment by checking running processes against the following list of common virtualization software:
- prl_cc.exe, prl_tools.exe, vmsrvc.exe, vmusrvc.exe, xenservice.exe, vboxservice.exe, vboxtray.exe, vboxcontrol.exe, vmwareservice.exe, vmwaretray.exe, tpautoconnsvc.exe, vmtoolsd.exe, vmwareuser.exe, python.exe, pythonw.exe.
- Checks if its being debugged or being subjected to 'anti-sandboxing' by checking if the following DLLs exist:
- sbiedll.dll, sbiedllx.dll, dir_watch.dll, wpespy.dll, wine_get_unix_file_name.
Analysis on file: b6ce47cc2a6dbf7309957cdfd3faf8a0ba3c2c8d