{
  "family": "psyme",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nPsyme is a classification for a family of malicious Trojans that rely heavily on scripting languages—specifically VBScript (.vbs) and JavaScript (.js)—to execute their payloads. Rather than using compiled executables (.exe), Psyme leverages the native Windows Script Host (WSH) to download and execute secondary malware, making it a frequent component in drive-by downloads and exploit kits.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPsyme is predominantly distributed via malicious websites (where the script is embedded directly into the HTML and executed via a browser vulnerability) or as an obfuscated script file attached to a phishing email (e.g., an invoice disguised as a `.pdf.vbs` file).\n\nUpon execution, Psyme leverages native Windows tools:\n<ul>\n<li><strong>Living off the Land (LotL):</strong> By executing via `wscript.exe` or `cscript.exe`, Psyme bypasses basic executable whitelisting and often avoids heuristic detection by older AV engines that focus solely on PE files.</li>\n<li><strong>Downloader Functionality:</strong> The script's primary function is to reach out to an attacker-controlled server (often using the `MSXML2.XMLHTTP` COM object) to download a secondary, more destructive payload (like a banking trojan or ransomware).</li>\n<li><strong>File System and Registry Manipulation:</strong> The script typically saves the downloaded payload to the `%Temp%` or `%AppData%` directory, modifies the Registry to ensure persistence (e.g., adding an entry to the `Run` key), and then executes the payload using the `WScript.Shell` object.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Psyme infection is a severe indicator of compromise (IoC) because it acts as the gateway for more destructive malware. The use of script-based downloaders is a common tactic for bypassing initial perimeter defenses and delivering ransomware payloads.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> EDR solutions must be configured to monitor the behavior of script interpreters (`wscript.exe`, `cscript.exe`, `powershell.exe`), particularly when they attempt to establish outbound network connections or execute files in temporary directories.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Isolate the infected endpoint and conduct a thorough forensic sweep to identify the specific secondary payload that Psyme successfully downloaded and executed.</li>\n<li><strong>System Hardening (GPO):</strong> To prevent future script-based attacks, configure Group Policy (GPO) to change the default file association for `.vbs` and `.js` files to open in Notepad rather than executing via WSH, and deploy Windows Defender Application Control (WDAC).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "JS/Psyme",
    "VBS/Psyme",
    "TrojanDownloader:JS/Psyme",
    "Win32/Psyme"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Psyme and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Psyme is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Psyme establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Psyme typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Psyme compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Psyme should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does JS/Psyme employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "JS/Psyme typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for JS/Psyme, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for JS/Psyme depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.005",
    "T1059.007",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "type": "Trojan / Downloader (Script-based)",
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "mitre_attack_detail": [
    {
      "id": "T1059.005",
      "name": "Command and Scripting Interpreter: Visual Basic (VBScript within the ASP file)",
      "tactic": "Execution"
    },
    {
      "id": "T1059.007",
      "name": "Command and Scripting Interpreter: JavaScript/JScript/AutoIt",
      "tactic": "Execution"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate affected host(s) from the internal network (disconnect physical Ethernet and disable Wi-Fi/Bluetooth) to prevent Psyme from spreading laterally or encrypting network-attached storage (NAS) and shared SMB volumes.",
    "Preserve volatile system memory (RAM capture) on a representative endpoint before attempting a reboot or power-down, as Psyme symmetric encryption keys or uncompiled payload components may still reside in memory.",
    "Audit process execution logs and terminate active scripting interpreters (e.g. PowerShell, CMD, WScript) or commands executing 'vssadmin.exe delete shadows' or 'wbadmin' used by Psyme to inhibit recovery.",
    "Investigate the initial compromise vector (such as exposed RDP instances, spearphishing attachments, or vulnerable edge gateways) and enforce an immediate credential reset for all compromised Active Directory accounts.",
    "Restore critical assets and databases exclusively from verified, air-gapped, or immutable offline backups once the Psyme binary and related persistence hooks are eradicated."
  ],
  "what_to_avoid": [
    "Do not restart or power cycle infected systems prematurely; doing so destroys volatile RAM encryption keys and may trigger bootloader locking logic embedded in Psyme.",
    "Avoid negotiating or paying the extortion demand without prior forensic evaluation and consultation with incident response specialists, as payment does not guarantee data recovery.",
    "Do not connect clean backup drives or external storage to the affected network until Psyme eradication is completely verified."
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}