Worm

About “Worm:Win32/Phorpiex” infection

Malware Removal

The Worm:Win32/Phorpiex is considered dangerous by lots of security experts. When this infection is active, you may notice unwanted processes in Task Manager list. In this case, it is adviced to scan your computer with GridinSoft Anti-Malware.

GridinSoft Anti-Malware

Gridinsoft Anti-Malware

Removing PC viruses manually may take hours and may damage your PC in the process. We recommend using GridinSoft Anti-Malware for virus removal. Allows to complete scan and cure your PC during the trial period.
6-day free trial available.

What Worm:Win32/Phorpiex virus can do?

  • Executable code extraction
  • Creates RWX memory
  • A process attempted to delay the analysis task.
  • Repeatedly searches for a not-found process, may want to run with startbrowser=1 option
  • Performs some HTTP requests
  • Unconventionial language used in binary resources: Russian
  • Detects Sandboxie through the presence of a library
  • Detects SunBelt Sandbox through the presence of a library
  • Attempts to remove evidence of file being downloaded from the Internet
  • Installs itself for autorun at Windows startup
  • Creates a hidden or system file
  • Attempts to modify proxy settings
  • Operates on local firewall’s policies and settings
  • Attempts to disable System Restore
  • Attempts to modify or disable Security Center warnings
  • Anomalous binary characteristics

Related domains:

eiiiaoihoaerulaf.co
roiriorisiorolaf.co
ouhgousgoahutlaf.co
oeoaoueuoeuoalaf.co
aiaizzzezeezelaf.co
ouauooaoaoeeulaf.co
oeeoeuueueuuelaf.co
eobbeaubfeuuelaf.co
aaaeieiiioffflaf.co
infineinfiniglaf.co
baoefubfbfigolaf.co
aaauuwiifoogelaf.co
plporsiszsgetlaf.co
eveezueigohehlaf.co
bnioooarubgzdlaf.co
aiuauuaaanggilaf.co
ghosrurruheudlaf.co
hohigoirjgrijlaf.co
ghofhauofeofhlaf.co
nehfauheudhuelaf.co
gouarhofhrufhlaf.co
rugeaofhefhuglaf.co
aefeohaueajdulaf.co
ghaueouahfuohlaf.co
rguaouhouaefelaf.co
aefhuoaeudofrlaf.co
guaouehdaouehlaf.co
feoanoanednuelaf.co
buaeaefuueofhlaf.co
bueoueoaoeoadlaf.co
lpliouhzieuaelaf.co
fgeauhfouehurlaf.co
aefoguaeoueorlaf.co
eiiiaoihoaerutrs.cc
roiriorisiorotrs.cc
ouhgousgoahuttrs.cc
oeoaoueuoeuoatrs.cc
aiaizzzezeezetrs.cc
ouauooaoaoeeutrs.cc
oeeoeuueueuuetrs.cc
eobbeaubfeuuetrs.cc
aauaaaeieiieetrs.cc
aaaeieiiioffftrs.cc
infineinfinigtrs.cc
baoefubfbfigotrs.cc
aaauuwiifoogetrs.cc
plporsiszsgettrs.cc
eveezueigohehtrs.cc
bnioooarubgzdtrs.cc
gshrghirhgsgrztd.io
hehfaofiehgggztd.io
soghrrsoeuhugztd.io
eiiiaoihoaeruztd.io
roiriorisioroztd.io
ouhgousgoahutztd.io
oeoaoueuoeuoaztd.io
aiaizzzezeezeztd.io
ouauooaoaoeeuztd.io
oeeoeuueueuueztd.io
eobbeaubfeuueztd.io
aauaaaeieiieeztd.io
aaaeieiiiofffztd.io
infineinfinigztd.io
baoefubfbfigoztd.io
gshrghirhgsgrpnr.su
hehfaofiehgggpnr.su
soghrrsoeuhugpnr.su
eiiiaoihoaerupnr.su
roiriorisioropnr.su
ouhgousgoahutpnr.su
oeeoeuueueuuepnr.su
eobbeaubfeuuepnr.su
aauaaaeieiieepnr.su
aaaeieiiiofffpnr.su
infineinfinigpnr.su
baoefubfbfigopnr.su
aaauuwiifoogepnr.su
plporsiszsgetpnr.su
eveezueigohehpnr.su
soghrrsoeuhuglaf.co
gshrghirhgsgrlaf.co
hehfaofiehggglaf.co

How to determine Worm:Win32/Phorpiex?


File Info:

crc32: B7A34034
md5: 2475518d8a1b7cef0845ce893de6563f
name: 2475518D8A1B7CEF0845CE893DE6563F.mlw
sha1: 737ce4b44644b45cedd84c2a1a42166f4cf97271
sha256: 010cf4d6a2b5606d212d002af391fea859167465956399140cd20ab1fc98a1e6
sha512: d061269b98b0d4dddbaa9e2e4c757182b770cf0d4cf8a4f80a61d6f9576388b4ca030605c64d729d30d04118949f05aa7e29667ddb4ccbefe3a73f5eb326def9
ssdeep: 6144:uoflQAACmO6HGd4RKzncYfHyBYiHm2UqHRkL76Q7NmFZIip6:uoObBH+4RKzhx2ksY
type: PE32 executable (GUI) Intel 80386, for MS Windows

Version Info:

0: [No Data]

Worm:Win32/Phorpiex also known as:

BkavW32.KjeadhENAL.Trojan
Elasticmalicious (high confidence)
DrWebTrojan.BtcMine.3342
CAT-QuickHealTrojan.Multi
ALYacTrojan.GenericKD.32184527
CylanceUnsafe
ZillyaWorm.Phorpiex.Win32.1246
SangforTrojan.Win32.ClipBanker.dzn
CrowdStrikewin/malicious_confidence_100% (W)
AlibabaTrojanBanker:Win32/ClipBanker.30f43f82
K7GWRiskware ( 0040eff71 )
K7AntiVirusRiskware ( 0040eff71 )
SymantecML.Attribute.HighConfidence
ESET-NOD32Win32/Phorpiex.V
APEXMalicious
AvastWin32:Dropper-gen [Drp]
CynetMalicious (score: 100)
KasperskyTrojan-Banker.Win32.ClipBanker.dzn
BitDefenderTrojan.GenericKD.32184527
NANO-AntivirusTrojan.Win32.ClipBanker.fugojy
ViRobotTrojan.Win32.S.Agent.297472.DM
MicroWorld-eScanTrojan.GenericKD.32184527
TencentWin32.Worm.Phorpiex.Hqbt
Ad-AwareTrojan.GenericKD.32184527
SophosMal/Generic-S
ComodoMalware@#2x11vllmk28ej
BitDefenderThetaGen:NN.ZexaF.34050.sqW@auPayalk
VIPRETrojan.Win32.Generic!BT
TrendMicroWorm.Win32.DORKBOT.TIGAAAR
McAfee-GW-EditionBehavesLike.Win32.Generic.dh
FireEyeGeneric.mg.2475518d8a1b7cef
EmsisoftTrojan.GenericKD.32184527 (B)
SentinelOneStatic AI – Malicious PE
JiangminTrojan.Banker.ClipBanker.dh
WebrootW32.Trojan.Gen
AviraTR/Spy.Banker.iirls
eGambitUnsafe.AI_Score_83%
Antiy-AVLTrojan/Generic.ASMalwS.2C18276
KingsoftWin32.Troj.Generic_a.a.(kcloud)
MicrosoftWorm:Win32/Phorpiex
GDataTrojan.GenericKD.32184527
McAfeeGenericRXIE-YZ!2475518D8A1B
MAXmalware (ai score=100)
VBA32TrojanBanker.ClipBanker
MalwarebytesTrojan.TLDR
PandaTrj/CI.A
TrendMicro-HouseCallWorm.Win32.DORKBOT.TIGAAAR
RisingTrojan.Generic@ML.85 (RDMK:pNQ636WUTrZBLm6kEdl+Hg)
YandexTrojan.GenAsa!U+2Y3mgmCeo
IkarusTrojan.SuspectCRC
MaxSecureTrojan.Malware.74447012.susgen
FortinetW32/Generic.AC.45A757
AVGWin32:Dropper-gen [Drp]
Paloaltogeneric.ml
Qihoo-360Win32/Backdoor.Predator.HwoCEpsA

How to remove Worm:Win32/Phorpiex?

Worm:Win32/Phorpiex removal tool
  • Download and install GridinSoft Anti-Malware.
  • Open GridinSoft Anti-Malware and perform a “Standard scan“.
  • Move to quarantine” all items.
  • Open “Tools” tab – Press “Reset Browser Settings“.
  • Select proper browser and options – Click “Reset”.
  • Restart your computer.

About the author

Paul Valéry

I'm a cyber security analyst and data science expert with 5+ years of experience with security software contractors.

Leave a Comment