Win32/Phorpiex [Threat Name] go to Threat

Win32/Phorpiex.C [Threat Variant Name]

Category	worm
Size	107998 B
Aliases	Trojan:Win32/Dorv.C!rfn (Microsoft)

Win32/Phorpiex.C is a worm that spreads via removable media. The worm serves as a backdoor. It can be controlled remotely.

When executed, the worm copies itself in some of the the following locations:

In order to be executed on every system start, the worm sets the following Registry entries:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "Microsoft Windows Manager" = "%malwareinstallfilepath%"
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
- "Microsoft Windows Manager" = "%malwareiinstallfilepath%"

The following Registry entry is set:

This disables the Windows Defender service.

The following Registry entry is set:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
- "%malwareiinstallfilepath%" = "%malwareiinstallfilepath%:*:Enabled:Microsoft Windows Manager"

The performed data entry creates an exception in the Windows Firewall program.

After the installation is complete, the worm deletes the original executable file.

The worm terminates its execution if it detects that it's running in a specific virtual environment.

Worm quits immediately if it detects loaded module within its own process containing one of the following strings in its name:

The worm searches local drives for files with the following file extensions:

Only following folders are searched:

When the worm finds a file matching the search criteria, it overwrites its content.

The worm may replace these files with a copy of itself.

Win32/Phorpiex.C is a worm that spreads via removable media.

The worm creates the following files:

The following file is dropped in the same folder:

The AUTORUN.INF file contains the path to the malware executable.

Thus, the worm ensures it is started each time infected media is inserted into the computer.

The worm moves the following files (source, destination):

It avoids files with the following filenames:

The worm collects the following information:

The worm attempts to send gathered information to a remote machine.

The worm acquires data and commands from a remote computer or the Internet.

The worm contains a list of (18) URLs. The TCP, IRC protocol is used in the communication.

It can execute the following operations: