Loading malware…
Phorpiex, also known as Trik, is a long-running Windows botnet and malware distribution platform derived from SDBot. Active for roughly a decade, it has been used by multiple threat actors to propagate itself and to deliver additional malware families, including ransomware, credential-stealing malware, spam bot payloads, and cryptocurrency miners. It is distinct from TrickBot despite the similar name.
Historically, Phorpiex spread through removable USB media, Windows Live Messenger, and Skype messaging. Later activity shows continued propagation through removable media and large-scale spam operations. The botnet has also been observed distributing ransomware families such as Nemty and serving as an access and delivery layer for other malware including GandCrab, Pushdo, and Pony.
Phorpiex uses IRC-based command and control and receives encrypted payload delivery instructions from its operators. Campaigns commonly involve downloading and executing additional malware or using infected hosts to distribute payloads via spam. Operators have demonstrated the ability to recover from sinkholing and to rotate or reuse infrastructure across campaigns. Some variants include anti-analysis logic, including checks for debugging and analysis environments, while other observed versions removed much of that functionality.
A notable later capability involved SMB-based worming to support ransomware deployment. In that mode, the malware scanned random public IP space for systems exposing SMB services, attempted authentication using hardcoded administrator usernames and weak or default passwords, copied itself to successfully accessed hosts, and launched remotely through the Windows Service Control Manager. In observed Nemty-related operations, this logic was used to determine whether a host had already been infected by Phorpiex and, if not, to download and execute the ransomware while continuing propagation.
Phorpiex has primarily targeted Windows systems and has functioned both as a self-propagating botnet and as a malware delivery service. Its long operational lifespan, spam capability, removable-media propagation, and support for secondary payload deployment have made it a durable criminal distribution platform.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
USB / rem drive spreader... create shortcut with the name of the drive and drive icon when open the shortcut it will open the hidden folder with all files and the bot
The Phorpiex team operates by infecting Windows computers and using these systems as spam bots to send out massive spam campaigns. These spam campaigns keep the spam botnet alive, by infecting new PCs with Phorpiex, but they also send out custom spam campaigns on behalf of other cybercrime groups.
First, the SMB component creates the following registry entry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"[PATH OF THE ORIGINAL FILE]" = "[PATH OF THE ORIGINAL FILE]:*:Enabled: Windows NetBIOS Driver"
PE Infector... infect them with ddownload and exec shellcode Infection works with 32 and 64 bit files
It also uses API Hashing to conceal the Windows functions it calls at runtime, and builds suspicious strings in memory byte by byte to bypass static security scanners.
This version of Trik uses a .NET loader that has the main bot split into several encrypted pieces saved in the resources of the .NET loader.
To avoid detection, the malware silently adds itself to the Windows Firewall’s list of allowed programs under the name “Microsoft Corporation,” making it appear as a trusted system component.
PE Infector... infect them with ddownload and exec shellcode Infection works with 32 and 64 bit files
operators have backtracked in sophistication by removing the anti-VM code from most of the samples we detected. However, they retained some of these features in other samples, including a version that uses a .NET loader and performs very basic anti-analysis.
First, the SMB component creates the following registry entry: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\"[PATH OF THE ORIGINAL FILE]" = "[PATH OF THE ORIGINAL FILE]:*:Enabled: Windows NetBIOS Driver"
it will scans all drives including USB and remote drives for .exe files and infect them
operators have backtracked in sophistication by removing the anti-VM code from most of the samples we detected. However, they retained some of these features in other samples, including a version that uses a .NET loader and performs very basic anti-analysis.
VNC Spreader and autoinfector... checks for port 5900, if port is open it start bruteforce and if logged in, it downloads your file with powershell and bitsadmin
To find targets, the SMB component generates random IP addresses then tries to connect to them on port 139... If access is granted, the malware uses the SMB protocol to copy itself to the remote machine.
"The developer for the Phorpiex botnet is extremely lazy and careless," the malware analyst said, claiming that he could have also hijacked the botnet in the past due to its simplistic IRC-based command and control mechanism.
Trik nodes communicate with their C&C servers using the IRC protocol and campaign payloads are sent to the bot in an encrypted state using a custom implementation of RC4.
It combines traditional command-and-control (C2) servers with a peer-to-peer (P2P) network, meaning that even if one server is taken down, the botnet continues to operate because infected machines talk directly to each other.
When we did spot IRC C&C servers online, we managed to capture a command for loading another malware to the infected machines... Tldr is a downloader that uses HTTP protocol for communication with C&C servers. Its main purpose is to load another malware on the infected machines.
52 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned as a propagation vector used to distribute JSWorm during its public RaaS phase.
A long-running botnet also known as Phorpiex that historically self-propagated via USB drives and messaging platforms, sends spam, distributes other malware families, and in this case delivers Nemty. A recent version used an SMB-spreading component with hardcoded credentials to copy itself to remote machines and then download and execute Nemty.
A long-running IRC-based botnet and worm used to propagate via Windows Live Messenger, Skype, removable USB storage, and later email spam. It distributes other malware payloads, supports bot updates, uses encrypted RC4-protected payload URLs, and includes some variants with basic anti-analysis features and a .NET loader.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.