SYMBOLCOMMON_NAMEaka. SYNONYMS
win.psix (Back to overview)

PsiX


According to Matthew Mesa, this is a modular bot. The name stems from the string PsiXMainModule in binaries until mid of September 2018.

In binaries, apart from BotModule and MainModule, references to the following Modules have be observed:
BrowserModule
BTCModule
ComplexModule
KeyLoggerModule
OutlookModule
ProcessModule
RansomwareModule
SkypeModule

References
2019-09-06ProofpointProofpoint Threat Insight Team
@online{team:20190906:psixbot:7f87948, author = {Proofpoint Threat Insight Team}, title = {{PsiXBot Now Using Google DNS over HTTPS and Possible New Sexploitation Module}}, date = {2019-09-06}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/psixbot-now-using-google-dns-over-https-and-possible-new-sexploitation-module}, language = {English}, urldate = {2019-12-20} } PsiXBot Now Using Google DNS over HTTPS and Possible New Sexploitation Module
PsiX
2019-09-05Twitter (@seckle_ch)Daniel Stirnimann
@online{stirnimann:20190905:doh:cdd8e54, author = {Daniel Stirnimann}, title = {{Tweet on DoH}}, date = {2019-09-05}, organization = {Twitter (@seckle_ch)}, url = {https://twitter.com/seckle_ch/status/1169558035649433600}, language = {English}, urldate = {2020-01-06} } Tweet on DoH
PsiX
2019-08-12ProofpointProofpoint Threat Insight Team
@online{team:20190812:psixbot:14fd373, author = {Proofpoint Threat Insight Team}, title = {{PsiXBot Continues to Evolve with Updated DNS Infrastructure}}, date = {2019-08-12}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/psixbot-continues-evolve-updated-dns-infrastructure}, language = {English}, urldate = {2019-12-20} } PsiXBot Continues to Evolve with Updated DNS Infrastructure
PsiX
2019-03-27Fox-ITStefano Antenucci, Antonio Parata
@online{antenucci:20190327:psixbot:9e1a258, author = {Stefano Antenucci and Antonio Parata}, title = {{PsiXBot: The Evolution Of A Modular .NET Bot}}, date = {2019-03-27}, organization = {Fox-IT}, url = {https://blog.fox-it.com/2019/03/27/psixbot-the-evolution-of-a-modular-net-bot/}, language = {English}, urldate = {2019-10-12} } PsiXBot: The Evolution Of A Modular .NET Bot
PsiX
2018-08-30Twitter (@mesa_matt)Matthew Mesa
@online{mesa:20180830:psix:18563f6, author = {Matthew Mesa}, title = {{Tweet on PsiX}}, date = {2018-08-30}, organization = {Twitter (@mesa_matt)}, url = {https://twitter.com/mesa_matt/status/1035211747957923840}, language = {English}, urldate = {2019-12-06} } Tweet on PsiX
PsiX

There is no Yara-Signature yet.