PsiXBot: The Evolution Of A Modular .NET Bot

FanJ · Mar 27, 2019

PsiXBot: The Evolution Of A Modular .NET Bot
Analysis by Fox-IT - 27 March 2019
https://blog.fox-it.com/2019/03/27/psixbot-the-evolution-of-a-modular-net-bot/

In this blog we will share our analysis of a modular piece of malware which is referred to by the author as PsiXBot. The malware first surfaced in 2017 but has recently undergone significant developments of its core and modules, which include the logging of keystrokes and stealing of Outlook and browser credentials. With these new developments done and the first large scale distributions observed in the wild, PsiXBot has officially made its debut in the malware ecosystem.
Click to expand...

Fox-IT actively monitors cyber criminal activity on a daily basis in order to proactively identify threats that are relevant to our customers. On the 21st of February 2019 we noticed SmokeLoader, a popular bot used to install additional malware on infected machines for a fee, push a task in order to distribute a .NET malware sample. Further research on the sample revealed a bot with a modular nature and capabilities, such as stealing data from infected hosts as well as receiving download & execute tasks. Our interest was further peaked when the Spelevo Exploit Kit started distributing the same malware on the 16th of March at which point we decided to further investigate this piece of malware, resulting in the findings below.
Click to expand...

guest · Aug 14, 2019

PsiXBot Continues to Evolve with Updated DNS Infrastructure
August 13, 2019
https://www.proofpoint.com/us/threa...t-continues-evolve-updated-dns-infrastructure

Earlier this year, FoxIT published research regarding the evolution of a .NET based malware known as “PsiXBot.”[1] We have continued to observe the malware in both malicious email and exploit kit campaigns.

Since the publication of this initial research, Proofpoint researchers have observed another evolution of PsiXbot (v1.0.2) which exhibits some key differences, including a new and unique method of dynamically fetching its own DNS infrastructure by utilizing a URL shortening service to gather the server IP addresses required to resolve the .bit domains used for command and control (C&C). [...]
Conclusion
PsiXBot continues to evolve with new ways of evading detection and new features to steal information. The .bit domains remain in use; however, it utilizes a new technique to retrieve the DNS servers required to connect. [...] this new version expands its list of modules, which pushes the bot’s capabilities in new directions.
The changes observed here demonstrate that the author or group behind this malware is committed to evolving this malware to compete in the threat landscape.
Click to expand...

guest · Sep 8, 2019

PsiXBot Now Using Google DNS over HTTPS and Possible New Sexploitation Module
September 6, 2019
https://www.proofpoint.com/us/threa...r-https-and-possible-new-sexploitation-module

Since posting our last PsiXBot update, the group or actor behind this malware has continued to make changes.
While tracking this threat, Proofpoint researchers noticed a change in the DNS resolution technique described in our previous blog, implementing Google’s DNS over HTTPS (DoH) service. We observed samples exhibiting this behavior as dropped payloads via the Spelevo Exploit Kit. These newer samples (later versions 1.0.2 and 1.0.3) now contain hard-coded C&C domains to be resolved with Google’s DoH service.

By using Google’s DoH service, it allows attackers to hide the DNS query to the C&C domain behind HTTPS. Unless SSL/TLS is being inspected by Man in the Middle (MitM), DNS queries to the C&C server will go unnoticed.
Conclusion
By expanding the feature set of the included modules and the overall capabilities of this malware, the actor or team behind its development appears to be seeking feature parity with other similar malware on the market.
We will continue to monitor PsiXBot as the current pace of updates suggests further refinements will not be far behind.
Click to expand...

Log in or Sign up

PsiXBot: The Evolution Of A Modular .NET Bot

FanJ Updates Team

guest Guest

guest Guest

Log in or Sign up

PsiXBot: The Evolution Of A Modular .NET Bot

FanJ Updates Team

guest Guest

guest Guest

Useful Searches