Palo Alto Comnie

Comnie runs the command: net start >> %TEMP%\info.dat on a victim.

Comnie uses ipconfig /all and route PRINT to identify network adapter and interface information.

Comnie uses RC4 and Base64 to obfuscate strings.

Comnie appends a total of 64MB of garbage data to a file to deter any security products in place that may be scanning files on disk.

Comnie executes the netstat -ano command.

Comnie uses the tasklist to view running processes on the victim’s machine.

Comnie executes BAT scripts.

Comnie executes VBS scripts.

Comnie uses HTTP for C2 communication.

Comnie collects the hostname of the victim machine.

Comnie uses the net user command.

Comnie uses blogs and third-party sites (GitHub, tumbler, and BlogSpot) to avoid DNS-based blocking of their communication to the command and control server.

Comnie executes a batch script to store discovery information in %TEMP%\info.dat and then uploads the temporarily file to the remote C2 server.

Comnie uses Rundll32 to load a malicious DLL.

Comnie attempts to detect several anti-virus products.

Comnie achieves persistence by adding a shortcut of itself to the startup path in the Registry.

Comnie establishes persistence via a .lnk file in the victim’s startup path.

Comnie encrypts command and control communications with RC4.