1. Home
  2. Software
  3. yty

yty

yty is a modular, plugin-based malware framework. The components of the framework are written in a variety of programming languages. [1]

ID: S0248
ⓘ
Type: MALWARE
ⓘ
Platforms: Windows
Version: 1.2
Created: 17 October 2018
Last Modified: 28 March 2020
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1005 从本地系统获取数据

yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.[1]
Enterprise T1113 屏幕捕获

yty collects screenshots of the victim machine.[1]
Enterprise T1083 文件和目录发现

yty gathers information on victim’s drives and has a plugin for document listing.[1]
Enterprise T1027 .001 混淆文件或信息: Binary Padding

yty contains junk code in its binary, likely to confuse malware analysts.[1]
.002 混淆文件或信息: Software Packing

yty packs a plugin with UPX.[1]
Enterprise T1082 系统信息发现

yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command systeminfo.[1]
Enterprise T1033 系统所有者/用户发现

yty collects the victim’s username.[1]
Enterprise T1016 系统网络配置发现

yty runs ipconfig /all and collects the domain name.[1]
Enterprise T1102 .002 网络服务: Bidirectional Communication

yty communicates to the C2 server by retrieving a Google Doc.[1]
Enterprise T1497 .001 虚拟化/沙盒规避: System Checks

yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware. [1]
Enterprise T1056 .001 输入捕获: Keylogging

yty uses a keylogger plugin to gather keystrokes.[1]
Enterprise T1057 进程发现

yty gets an output of running processes using the tasklist command.[1]
Enterprise T1018 远程系统发现

yty uses the net view command for discovery.[1]
Enterprise T1053 .005 预定任务/作业: Scheduled Task

yty establishes persistence by creating a scheduled task with the command SchTasks /Create /SC DAILY /TN BigData /TR " + path_file + "/ST 09:30".[1]

References

  1. Schwarz, D., Sopko J. (2018, March 08). Donot Team Leverages New Modular Malware Framework in South Asia. Retrieved June 11, 2018.