Technical Information
To ensure autorun and distribution
Creates or modifies the following files
- <SYSTEM32>\tasks\tooykupdate
Malicious functions
Executes the following
- '%WINDIR%\syswow64\net.exe' stop xlkfs
- '%WINDIR%\syswow64\net.exe' stop YService
- '%WINDIR%\syswow64\net.exe' stop YServiceRun
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%ProgramFiles%\RealVNC\VNC Server\vncserver.exe" "VNC Server" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\rserver30\rserver3.exe" "rserver3" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk.exe" "ToDesk" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk_Session.exe" "ToDesk_Session" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk_Service.exe" "ToDesk_Service" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Service.exe" "YService" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Server.exe" "YServer" ENABLE
- '%WINDIR%\syswow64\netsh.exe' firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\vpn.exe" "YVPN" ENABLE
Modifies file system
Creates the following files
- %TEMP%\autb2ab.tmp
- %TEMP%\aut519.tmp
- %WINDIR%\syswow64\ykjlfwd\vncserver.exe
- %TEMP%\aut4d9.tmp
- %WINDIR%\syswow64\ykjlfwd\ttvncs.exe
- %TEMP%\aut49a.tmp
- %WINDIR%\syswow64\ykjlfwd\vpn.exe
- %TEMP%\aut1db.tmp
- %WINDIR%\syswow64\ykjlfwd\server.exe
- %TEMP%\aut1bb.tmp
- %WINDIR%\syswow64\ykjlfwd\service.exe
- %WINDIR%\syswow64\ykjlfwd\devcon.exe
- %TEMP%\aut16c.tmp
- %TEMP%\autf3f3.tmp
- %WINDIR%\syswow64\ykjlfwd\todesk\todesk_session.exe
- %TEMP%\autf25c.tmp
- %WINDIR%\syswow64\ykjlfwd\todesk\todesk_service.exe
- %TEMP%\autf0d5.tmp
- %WINDIR%\syswow64\ykjlfwd\todesk\todesk.exe
- %TEMP%\autee55.tmp
- %TEMP%\932ywrhhzy
- %TEMP%\autaf71.tmp
- %TEMP%\1960kitraug
- %WINDIR%\syswow64\ykjlfwd\todesk\config.ini
- %TEMP%\aut529.tmp
Deletes the following files
- %TEMP%\autb2ab.tmp
- %TEMP%\1960kitraug
- %TEMP%\autaf71.tmp
- %TEMP%\932ywrhhzy
- %TEMP%\autee55.tmp
- %TEMP%\autf0d5.tmp
- %TEMP%\autf25c.tmp
- %TEMP%\autf3f3.tmp
- %TEMP%\aut16c.tmp
- %TEMP%\aut1bb.tmp
- %TEMP%\aut1db.tmp
- %TEMP%\aut49a.tmp
- %TEMP%\aut4d9.tmp
- %TEMP%\aut519.tmp
- %TEMP%\aut529.tmp
Miscellaneous
Creates and executes the following
- '%WINDIR%\syswow64\ykjlfwd\service.exe' /ErrorStdOut -StartS
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /TN TooykUpdate /RU user /SC ONCE /ST 21:47:01 /RL HIGHEST /F /TR "'<Full path to file>' /Task"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\vpn.exe" "YVPN" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Server.exe" "YServer" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Service.exe" "YService" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk_Service.exe" "ToDesk_Service" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk_Session.exe" "ToDesk_Session" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk.exe" "ToDesk" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\rserver30\rserver3.exe" "rserver3" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%ProgramFiles%\RealVNC\VNC Server\vncserver.exe" "VNC Server" ENABLE' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop YService' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer_Service.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer.exe"' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop xlkfs' (with hidden window)
- '<Full path to file>' /Task' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /run /TN TooykUpdate /I' (with hidden window)
- '%WINDIR%\syswow64\cmd.exe' /c net stop YServiceRun' (with hidden window)
- '%WINDIR%\syswow64\ykjlfwd\service.exe' /ErrorStdOut -StartS' (with hidden window)
Executes the following
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /create /TN TooykUpdate /RU user /SC ONCE /ST 21:47:01 /RL HIGHEST /F /TR "'<Full path to file>' /Task"
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Service.exe" "YService" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk_Service.exe" "ToDesk_Service" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk_Session.exe" "ToDesk_Session" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ToDesk\ToDesk.exe" "ToDesk" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\ttvncs.exe" "TTVNC" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\rserver30\rserver3.exe" "rserver3" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%ProgramFiles%\RealVNC\VNC Server\vncserver.exe" "VNC Server" ENABLE
- '%WINDIR%\syswow64\net1.exe' stop YServiceRun
- '%WINDIR%\syswow64\cmd.exe' /c net stop YServiceRun
- '%WINDIR%\syswow64\net1.exe' stop YService
- '%WINDIR%\syswow64\cmd.exe' /c net stop YService
- '%WINDIR%\syswow64\netsh.exe' firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer_Service.exe"
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer_Service.exe"
- '%WINDIR%\syswow64\netsh.exe' firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe"
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer_Desktop.exe"
- '%WINDIR%\syswow64\netsh.exe' firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer.exe"
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall delete allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\TeamViewer\TeamViewer.exe"
- '%WINDIR%\syswow64\net1.exe' stop xlkfs
- '%WINDIR%\syswow64\cmd.exe' /c net stop xlkfs
- '<SYSTEM32>\taskeng.exe' {3A073459-C688-4921-A0D6-75882C51AC1E} S-1-5-21-1960123792-2022915161-3775307078-1001:cfdmph\user:Interactive:[1]
- '%WINDIR%\syswow64\schtasks.exe' /create /TN TooykUpdate /RU user /SC ONCE /ST 21:47:01 /RL HIGHEST /F /TR "'<Full path to file>' /Task"
- '%WINDIR%\syswow64\schtasks.exe' /run /TN TooykUpdate /I
- '%WINDIR%\syswow64\cmd.exe' /c schtasks /run /TN TooykUpdate /I
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\Server.exe" "YServer" ENABLE
- '%WINDIR%\syswow64\cmd.exe' /c netsh firewall add allowedprogram "%WINDIR%\SysWOW64\YKJLFWD\vpn.exe" "YVPN" ENABLE
