yty
yty is a modular, plugin-based malware framework. The components of the framework are written in a variety of programming languages. [1]
Techniques Used
Domain | ID | Name | Use | |
---|---|---|---|---|
Enterprise | T1005 | Data from Local System |
yty collects files with the following extensions: .ppt, .pptx, .pdf, .doc, .docx, .xls, .xlsx, .docm, .rtf, .inp, .xlsm, .csv, .odt, .pps, .vcf and sends them back to the C2 server.[1] |
|
Enterprise | T1083 | File and Directory Discovery |
yty gathers information on victim’s drives and has a plugin for document listing.[1] |
|
Enterprise | T1056 | .001 | Input Capture: Keylogging | |
Enterprise | T1027 | .001 | Obfuscated Files or Information: Binary Padding |
yty contains junk code in its binary, likely to confuse malware analysts.[1] |
.002 | Obfuscated Files or Information: Software Packing | |||
Enterprise | T1057 | Process Discovery |
yty gets an output of running processes using the |
|
Enterprise | T1018 | Remote System Discovery | ||
Enterprise | T1053 | .005 | Scheduled Task/Job: Scheduled Task |
yty establishes persistence by creating a scheduled task with the command |
Enterprise | T1113 | Screen Capture | ||
Enterprise | T1082 | System Information Discovery |
yty gathers the computer name, the serial number of the main disk volume, CPU information, Microsoft Windows version, and runs the command |
|
Enterprise | T1016 | System Network Configuration Discovery | ||
Enterprise | T1033 | System Owner/User Discovery | ||
Enterprise | T1497 | .001 | Virtualization/Sandbox Evasion: System Checks |
yty has some basic anti-sandbox detection that tries to detect Virtual PC, Sandboxie, and VMware. [1] |
Enterprise | T1102 | .002 | Web Service: Bidirectional Communication |
yty communicates to the C2 server by retrieving a Google Doc.[1] |