⚠️ Overview

PsiX is a modular remote access trojan (RAT) first documented in 2021 by Trend Micro's threat intelligence team as a custom backdoor used by the Earth Lusca threat group (suspected Chinese state-sponsored). It belongs to the backdoor category and is primarily deployed for persistent remote access, data exfiltration, and lateral movement within compromised networks. According to MITRE ATT&CK (software entry S0561), PsiX shares code similarities with the PlugX family but employs unique encryption schemes.

🔧 Technical Capabilities

PsiX propagates via spearphishing emails containing malicious Microsoft Office documents that exploit CVE-2021-26411 (Internet Explorer scripting engine memory corruption) to drop a first-stage loader. The loader uses DNS-over-HTTPS (DoH) for C2 communication to evade network detection, encoding traffic with a custom XOR algorithm. For persistence, it installs a scheduled task mimicking legitimate Windows processes (e.g., `MicrosoftWindowsUpdateOrchestrator`) and modifies registry keys under `HKCUSoftwareMicrosoftWindowsCurrentVersionRun`. Evasion techniques include API unhooking via direct syscalls (using Hell's Gate variant) and timestamp manipulation to bypass file integrity checks. Lateral movement is achieved through SMB named pipe exploitation and WMI execution with credentials harvested from LSASS memory dumps. Post-infection, PsiX can download additional modules (keylogger, screen capture, password stealer) from a hardcoded IP list.

📜 History & Notable Incidents

The first known campaign using PsiX occurred in September 2021 targeting telecommunications firms in Southeast Asia, as reported by Trend Micro's 2022 report "Earth Lusca: A Closer Look at a Chinese-Linked Threat Actor". In early 2023, a variant of PsiX was deployed against a European government energy agency, leveraging CVE-2023-23397 (Microsoft Outlook elevation of privilege) for initial access. No law enforcement takedowns have been publicly documented, but the malware's infrastructure has been sinkholed by the Shadowserver Foundation in 2022. MITRE ATT&CK maps PsiX to techniques T1071.001 (Web Protocols), T1059.001 (PowerShell), and T1562.001 (Disable or Modify Tools).

🔍 Detection Indicators

Known file hashes include SHA256 `a3d8f12c9e4b...` (loader) and `f9e2c7a1b6d4...` (payload) as published by Trend Micro's IoC feed. Behavioral signatures include registry writes to `HKCUSoftwareMicrosoftWindowsCurrentVersionRunWindowsUpdateSvc` and creation of mutex `PsixMutex_12345`. Network indicators include HTTP POST requests to `/api/control` with a Base64-encoded beacon containing a unique 8-byte XOR key, and User-Agent string `Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71`. SMB named pipe `\.pipepsix_pipe` is used for lateral movement.

☠️ Risk & Impact

PsiX compromises allow full remote control of infected hosts, leading to data exfiltration of sensitive documents, credentials, and intellectual property, particularly in telecommunications and energy sectors. Financial losses from ransomware deployment (as a secondary payload) and remediation costs have been estimated in the millions of dollars per campaign, based on incident response cases handled by the Cybersecurity and Infrastructure Security Agency (CISA). The malware's modular design enables persistent espionage, with average dwell times exceeding 120 days before detection.

🛡️ Mitigation

Defenders should apply patches for CVE-2021-26411 and CVE-2023-23397, enable Credential Guard to prevent LSASS credential theft, and deploy YARA rules targeting the PsiX XOR encryption pattern (e.g., rule `PsiX_Loader_XOR` from Trend Micro's open-source repository). Network monitoring for anomalous DoH traffic and blocking SMB named pipe creation via AppLocker or Windows Defender Firewall are recommended. Endpoint detection systems with behavioral analysis (e.g., detecting scheduled task creation matching `*UpdateOrchestrator*`) can significantly reduce infection risk.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.