Loading malware…
Phorpiex, also known as Trik, is a modular Windows malware family and botnet used for mass spam, sextortion, cryptocurrency theft, cryptojacking, and delivery of additional malware. It compromises consumer and enterprise systems globally and provides malware-distribution services to other cybercriminal operations. Its payloads have included information stealers, XMRig cryptocurrency miners, and ransomware families such as Avaddon, Nemty, GandCrab, and BitRansomware.
Early Phorpiex variants used IRC command and control. During 2018–2019, the operation shifted toward an HTTP-controlled modular architecture centered on the Tldr loader. Tldr downloads and executes additional components, maintains persistence through Windows startup registry entries, and supports propagation through removable and remote drives. Some variants infect executable files or use malicious shortcuts to spread. Additional worm modules expand infections through NetBIOS and exposed VNC services; the VNC module scans for accessible servers, brute-forces weak passwords, and simulates keyboard input to execute payload-download commands. Distribution has also involved phishing emails, malicious attachments, deceptive software-download sites, instant messaging, exploit kits, and other malware.
Phorpiex spam modules conduct large-scale malicious email and fraudulent sextortion campaigns. Earlier variants can brute-force SMTP credentials and report successful credentials to their operators. Its cryptocurrency clipper monitors the clipboard and substitutes attacker-controlled wallet addresses to redirect payments. Other components collect and exfiltrate file listings and host information. Defense-evasion features include virtualization and debugger checks, hidden files, removal of downloaded-file security metadata, firewall exceptions, and attempts to disable Windows Defender and other security controls.
The Twizt variant introduced peer-to-peer command propagation, allowing operation without continuously available centralized command-and-control servers. It uses a custom TCP/UDP protocol and can configure port forwarding on UPnP-enabled routers so infected Windows hosts can accept inbound peer connections.
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Campaign: 现役军人11 (Active Army11) ... Observed commodity malware: Phorpiex and Emotet.
A single 11KB Phorpiex worm dropper hit MalwareBazaar at 02:10 UTC on April 20, 2026.
58 distinct techniques documented for this family, organized by ATT&CK tactic.
This is an SMTP email spoofing engine that automatically sends phishing or spam emails through compromised mail servers with completely forged headers to hide the malware’s origin.
Phorpiex is mostly known for its massive sextortion spam campaigns...
By leveraging on commodity malware, they are attempting to operate under the cloak of anonymity to avoid being identified as state-sponsored hacker groups.
Some Tldr samples have the functionality of a computer worm and can spread through removable drives.
Phorpiex is spread through exploit kits and with the help of other malware... Dropped by RIG EK 2019-05-29
The bot loader has been propagated through a variety of means over the years, including being loaded by other malware, freeware, and unwanted programs, or delivered by phishing emails from already-infected bots.
In 2020 and 2021 we observed the bot loader being spread through Phorpiex bot-delivered emails with .zip or other archive file attachments.
Possible Initial Infection Vectors Based on the observed infection chain and historical Phorpiex activity, victims were likely targeted through one or more of the following delivery mechanisms: Phishing emails with links to downloader malware.
In February of 2021, infected implants also downloaded additional Etherium miners. These miners create scheduled tasks are labeled “WindowsUpdate” but run the miner every minute.
"...it hijacks your computer’s 'healthy' programs, like PowerShell and Command Prompt... These commands download the actual virus..."
if logged in, it downloads your file with powershell and bitsadmin
“…using CMD and PowerShell to execute the payload.”
if logged in, it downloads your file with powershell and bitsadmin
This is because malware botnet operators often rely on social engineering to trick users into installing malware on their systems themselves, even if computers are running up-to-date software.
bot automatically download, decrypt and execute them
It then uses the Windows Service Control Manager to start the SMB component’s process on the remote machine.
In February of 2021, infected implants also downloaded additional Etherium miners. These miners create scheduled tasks are labeled “WindowsUpdate” but run the miner every minute.
This includes modifying registry keys to disable firewall and antivirus popups or functionality, overriding proxy and browser settings, setting the loader and executables to run at startup, and adding these executables to the authorized application lists.
if logged in, it downloads your file with powershell and bitsadmin
After that the malware uses sc.exe to stop windows update-related services by running the following command : /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
This includes modifying registry keys to disable firewall and antivirus popups or functionality, overriding proxy and browser settings, setting the loader and executables to run at startup
The bot then copies all its file configurations and include a malicious DriveMgr.exe, a copy of the loader, as well as a .lnk file that runs the malware when opened.
In February of 2021, infected implants also downloaded additional Etherium miners. These miners create scheduled tasks are labeled “WindowsUpdate” but run the miner every minute.
PE Infector... infect them with ddownload and exec shellcode Infection works with 32 and 64 bit files
After that the malware uses sc.exe to stop windows update-related services by running the following command : /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS
This includes modifying registry keys to disable firewall and antivirus popups or functionality, overriding proxy and browser settings, setting the loader and executables to run at startup
The bot then copies all its file configurations and include a malicious DriveMgr.exe, a copy of the loader, as well as a .lnk file that runs the malware when opened.
It also uses API Hashing to conceal the Windows functions it calls at runtime, and builds suspicious strings in memory byte by byte to bypass static security scanners.
This version of Trik uses a .NET loader that has the main bot split into several encrypted pieces saved in the resources of the .NET loader.
As the bot loader updates, the key values change to reflect new files, randomized file paths, and masqueraded system files. The example below illustrates a change from SVCHOST to LSASS
PE Infector... infect them with ddownload and exec shellcode Infection works with 32 and 64 bit files
First the Zone Identifier is stripped if present... DeleteFileA ; delete the zone.identifier s
After the mutex is created, the malware attempts to delete the zone identifier... the malware attempts to get the Alternate Data Stream (ADS) of the file, specifically the Zone.Identifier stream, and deletes it using DeleteFileW.
if logged in, it downloads your file with powershell and bitsadmin
operators have backtracked in sophistication by removing the anti-VM code from most of the samples we detected. However, they retained some of these features in other samples, including a version that uses a .NET loader and performs very basic anti-analysis.
The malware uses two anti-VM techniques. The first targets Virtual Box, VMware, QEMU and potentially other products. The second targets Sandboxie.
The malware hides both the executable and the parent directory by marking them a hidden and read-only system directory/file
Determine if it is being debugged with IsDebuggerPresent.
This includes modifying registry keys to disable firewall and antivirus popups or functionality, overriding proxy and browser settings, setting the loader and executables to run at startup, and adding these executables to the authorized application lists.
The bot also establishes persistence and attempts to disable security controls.
checks for port 5900, if port is open it start bruteforce and if logged in, it downloads your file
Privileges : Check if running as admin (“A”) or user (“U”) using IsUserAnAdmin
Phorpiex bots continuously scan domain names and IP addresses extracted from the configuration. Even if a valid C&C server responds, the malware continues to query other hosts.
The routine get_id_string identifies the following os information: Window Version... Country... 32bit or 64bit
it will scans all drives including USB and remote drives for .exe files and infect them
The purpose of Tldr, and modules such as the VNC Worm and the NetBIOS Worm, is to distribute the botnet as much as possible.
operators have backtracked in sophistication by removing the anti-VM code from most of the samples we detected. However, they retained some of these features in other samples, including a version that uses a .NET loader and performs very basic anti-analysis.
The malware uses two anti-VM techniques. The first targets Virtual Box, VMware, QEMU and potentially other products. The second targets Sandboxie.
We also observed variants of the malware that act like a file virus infecting other software.
The use of ip-api.com, a public IP geolocation service, suggests that the malware may be collecting information about the infected host’s external IP address and geographic location.
Determine if it is being debugged with IsDebuggerPresent.
VNC Spreader and autoinfector... checks for port 5900, if port is open it start bruteforce and if logged in, it downloads your file with powershell and bitsadmin
To find targets, the SMB component generates random IP addresses then tries to connect to them on port 139... If access is granted, the malware uses the SMB protocol to copy itself to the remote machine.
Some Tldr samples have the functionality of a computer worm and can spread through removable drives.
Phorpiex is a worm that spreads through USB drives and network drives.
The shortened STIX 2.1 report object includes labels such as "mitre:t1005".
Each batch file contained approximately 8,000 plaintext email:password credential pairs.
The malware alters crypto wallet addresses in a clipboard, and the money is transferred to the wallet that belongs to the malware operators.
Write the downloaded executable from Step 10 to the ZIP file from Step 12. The ZIP file is built manually, field by field.
Phorpiex has shifted some of its previous command-and-control (C2) architecture away from its traditional hosting, favoring domain generation algorithm (DGA) domains over branded and static domains.
When first run, Phorpiex Tldr performs check-in HTTP requests to its C&C servers, using a hardcoded list of C&C servers... In each thread, the malware queries the following URL: http://<cnc_host>/t.php?new=1
Point Wild observed the process establishing multiple concurrent SMTP connections to numerous external mail servers shortly after execution... This pattern is consistent with malware leveraging infected systems to distribute large volumes of email messages as part of a spam or botnet-driven operation.
The same infected machine connects to the local mail server (192.168.4.103:25). Because it’s internal and locally authenticated, the mail server SKIPS Spamhaus checks... The mail server accepts the relay request and forwards sextortion emails with spoofed sender addresses
Trik uses a layer of SOCKS proxies to hide the real C&C servers.
It was called “Twizt” and enables the botnet to operate successfully without active C&C servers, since it can operate in peer-to-peer mode.
It uses three distinct types of C2 to fulfil different goals during and after installation: Downloading the Phorpiex malware implant Downloading updates to the Phorpiex implant and new exploit modules
In a very recent development, we observed that most Phorpiex bot loader malware have abandoned branded C2 domains and have completely moved to using IPs or DGA domains.
We also noticed that, shortly after a spam campaign, the C&Cs would close their C&C port until the following day at which point it would re-open, ready for a new campaign.
Target: Retails and consumer goods industry Motivation: Data exfiltration and extortion
the now-defunct Avaddon gang using Phorpiex bots to deploy their ransomware inside corporate networks last year
Cryptojacking is the unauthorized use of someone else’s computer to mine cryptocurrency. One of the final payloads loaded to Phorpiex-controlled computers is XMRig mining software.
485 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.