Phorpiex
Aliases: Trik, phorphiex
- First seen
- 2016-01-01 00:00:00
- Malware type
- botnet, downloader, cryptominer
- Family
- Malware family
- Last IoC activity
- 2026-07-22 02:45:33
- Profile updated
- 2026-07-07 12:55:10
Context
Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.
Detection coverage
- 2 YARA rules
Detection rules
- DITEKSHEN_MALWARE_Win_Phorpiex (yara-rule)
- MALPEDIA_Win_Phorpiex_Auto (yara-rule)
Reports & references
- CrowdStrike — Pinchy Spider Adopts Big Game Hunting (report)
- cronup.com — De Ataque Con Malware A Incidente De Ransomware (report)
- Broadcom/Symantec — Nemty Ransomware Trik Botnet (report)
- lastline.com — Nemty Ransomware Scaling Up Apac Mailboxes Swarmed Dual Downloaders (report)
- zdnet.com — The Malware That Usually Installs Ransomware And You Need To Remove Right Away (report)
- McAfee — Evolution Of Malware Sandbox Evasion Tactics A Retrospective Study (report)
- McAfee — Evolution Of Malware Sandbox Evasion Tactics A Retrospective Study (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Phorpiex (report)
- Microsoft — Phorpiex Morphs How A Longstanding Botnet Persists And Thrives In The Current Threat Environment (report)
- bin.re — Phorpiex (report)
- bleepingcomputer.com — Trik Spam Botnet Leaks 43 Million Email Addresses (report)
- Trend Micro — Shylock Not The Lone Threat Targeting Skype (report)
- therecord.media — Phorpiex Botnet Shuts Down Source Code Goes Up For Sale (report)
- proofpoint.com — Phorpiex Decade Spamming Shadows (report)
- zdnet.com — Someone Is Uninstalling The Phorpiex Malware From Infected Pcs And Telling Users To Install An Antivirus (report)
- research.checkpoint.com — Phorpiex Botnet Is Back With A New Twizt Hijacking Hundreds Of Crypto Transactions (report)
- blogs.vmware.com — Telemetry Peak Analyzer An Automatic Malware Campaign Detector (report)
- research.checkpoint.com — Phorpiex Breakdown (report)
- research.checkpoint.com — Phorpiex Arsenal Part I (report)
- twitter.com — 1447852018794643457 (report)
- johannesbader.ch — Phorpiex (report)