{
  "family": "psyme",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nPsyme is a classification for a family of malicious Trojans that rely heavily on scripting languages—specifically VBScript (.vbs) and JavaScript (.js)—to execute their payloads. Rather than using compiled executables (.exe), Psyme leverages the native Windows Script Host (WSH) to download and execute secondary malware, making it a frequent component in drive-by downloads and exploit kits.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nPsyme is predominantly distributed via malicious websites (where the script is embedded directly into the HTML and executed via a browser vulnerability) or as an obfuscated script file attached to a phishing email (e.g., an invoice disguised as a `.pdf.vbs` file).\n\nUpon execution, Psyme leverages native Windows tools:\n<ul>\n<li><strong>Living off the Land (LotL):</strong> By executing via `wscript.exe` or `cscript.exe`, Psyme bypasses basic executable whitelisting and often avoids heuristic detection by older AV engines that focus solely on PE files.</li>\n<li><strong>Downloader Functionality:</strong> The script's primary function is to reach out to an attacker-controlled server (often using the `MSXML2.XMLHTTP` COM object) to download a secondary, more destructive payload (like a banking trojan or ransomware).</li>\n<li><strong>File System and Registry Manipulation:</strong> The script typically saves the downloaded payload to the `%Temp%` or `%AppData%` directory, modifies the Registry to ensure persistence (e.g., adding an entry to the `Run` key), and then executes the payload using the `WScript.Shell` object.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Psyme infection is a severe indicator of compromise (IoC) because it acts as the gateway for more destructive malware. The use of script-based downloaders is a common tactic for bypassing initial perimeter defenses and delivering ransomware payloads.\n\n<h3>Remediation and Eradication</h3>\n<ul>\n<li><strong>Endpoint Detection and Response (EDR):</strong> EDR solutions must be configured to monitor the behavior of script interpreters (`wscript.exe`, `cscript.exe`, `powershell.exe`), particularly when they attempt to establish outbound network connections or execute files in temporary directories.</li>\n<li><strong>Network Isolation and Sweeps:</strong> Isolate the infected endpoint and conduct a thorough forensic sweep to identify the specific secondary payload that Psyme successfully downloaded and executed.</li>\n<li><strong>System Hardening (GPO):</strong> To prevent future script-based attacks, configure Group Policy (GPO) to change the default file association for `.vbs` and `.js` files to open in Notepad rather than executing via WSH, and deploy Windows Defender Application Control (WDAC).</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "JS/Psyme",
    "VBS/Psyme",
    "TrojanDownloader:JS/Psyme",
    "Win32/Psyme"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1059.005",
    "T1059.007",
    "T1105",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T06:52:06Z",
  "type": "Trojan / Downloader (Script-based)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}