Malware

Phorpiex

Also known as: Trik · phorphiex

Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.

Indicators of Compromise 22

Filename /churl Filename /fsave Filename /hiddenbin/ Filename st.exe SHA-256 01a96eeafb72042b3f69afd21b4c9155dbfe7f97ab3dca392972ad531a075ac2 SHA-256 9639f7ebc6a6d69d7bf5b8bc869e7783a1406088f192868624ad8919e9bfd1d4 SHA-256 bf24277400cc453d530e4277d3bd24e96c5e409adef6970518bdc59205aa0241 SHA-256 cc43cdbe8eb9874f55fffbe23b560b673eb9f31fb9a953926bba29464fd2dd07 SHA-256 e310476c41ae4f6e3c4ed9bb88303ee6e5e1455bd7afe51cf48965ea7599e6e5 SHA-256 e3513922666c202c1ae5c06eea277ba10477868d6d89ce2819f4f8ff9070bc85 SHA-256 e5715e6611ef6bcb233f5d2098510dab3db408abbb728b00e1821bb255829373 IP 103[.]245[.]236[.]146 IP 154[.]92[.]19[.]71 IP 178[.]16[.]54[.]109 IP 178[.]16[.]54[.]31 IP 18[.]228[.]188[.]56 IP 194[.]76[.]227[.]94 IP 2[.]26[.]98[.]67 IP 206[.]189[.]229[.]43 IP 62[.]60[.]179[.]230 IP 87[.]120[.]107[.]33 IP 91[.]92[.]243[.]29

MITRE ATT&CK TTPs 5

T1027
Obfuscated Files or Information
Defense Evasion
 T1048
Exfiltration Over Alternative Protocol
Exfiltration
 T1059
Command and Scripting Interpreter
Execution
 T1071.001
Web Protocols
Command And Control
 T1090
Proxy
Command And Control

Source Articles

Almost Half of Malware Samples Communicate Direct to IP
A significant portion of malware samples bypass DNS by communicating directly to IP addresses, evading DNS-based security controls. Analysis of 4 million dynamic reports shows 45.32% of malware with command-and-control (C2) activity used direct-to-IP (D2IP) connections, accounting for 23.17% of all C2 attempts. Threats identified include Phorpiex ransomware droppers, a data exfiltration campaign using obfuscated \GET requests, SectopRAT deployments targeting educational institutions, and IoT botnets like Mozi and a new Mirai variant named Boatnet. These threats leverage hard-coded IP addresses and custom HTTP methods to avoid detection and maintain persistence.
unit42 ·4h ago