Heyoka Backdoor can use DNS tunneling for C2 communications.^[1]

Heyoka Backdoor can establish persistence with the auto start function including using the valueEverNoteTrayUService.^[1]

Heyoka Backdoor can decrypt its payload prior to execution.^[1]

Heyoka Backdoor has the ability to search the compromised host for files.^[1]

Heyoka Backdoor has the ability to delete folders and files from a targeted system.^[1]

Heyoka Backdoor can enumerate drives on a compromised host.^[1]

Heyoka Backdoor has been namedsrvdll.dll to appear as a legitimate service.^[1]

Heyoka Backdoor can encrypt its payload.^[1]

Heyoka Backdoor can identify removable media attached to victim's machines.^[1]

Heyoka Backdoor can gather process information.^[1]

Heyoka Backdoor can inject a DLL into rundll32.exe for execution.^[1]

Heyoka Backdoor can use spoofed DNS requests to create a bidirectional tunnel between a compromised host and its C2 servers.^[1]

Heyoka Backdoor can use rundll32.exe to gain execution.^[1]

Heyoka Backdoor can check if it is running as a service on a compromised host.^[1]

Heyoka Backdoor has been spread through malicious document lures.^[1]

^[1]