0x007CFABF  video  Desktop video recording    0x06E533C4  download  Downloads executable and injects into new process    0x00684509  ammyy  Ammyy Admin tool    0x07C6A8A5  update  Updates self    0x0B22A5A7     Add/Update klgconfig (analysis incomplete)    0x0B77F949  httpproxy  Starts HTTP proxy    0x07203363  killos  Renders computer unbootable by wiping the MBR    0x078B9664  reboot  Reboots the operating system    0x07BC54BC  tunnel  Creates a network tunnel    0x07B40571  adminka  Adds new C2 server or proxy address for pseudo-HTTP protocol    0x079C9CC2  server  Adds new C2 server for custom binary protocol    0x0007C9C2  user  Creates or deletes Windows user account    0x000078B0  rdp  Enables concurrent RDP (analysis incomplete)    0x079BAC85  secure  Adds Notification Package (analysis incomplete)    0x00006ABC  del  Deletes file or service    0x0A89AF94  startcmd  Adds command to the configuration file (see the Configuration section)    0x079C53BD  runmem  Downloads executable and injects directly into new process    0x0F4C3903  logonpasswords  Send Windows accounts details to the C2 server    0x0BC205E4  screenshot  Takes a screenshot of the desktop and sends it to the C2 server    0x007A2BC0  sleep  Backdoor sleeps until specified date    0x0006BC6C  dupl  Unknown    0x04ACAFC3     Upload files to the C2 server    0x00007D43  vnc  Runs VNC plugin    0x09C4D055  runfile  Runs specified executable file    0x02032914  killbot  Uninstalls backdoor    0x08069613  listprocess  Returns list of running processes to the C2 server    0x073BE023  plugins  Change C2 protocol used by plugins    0x0B0603B4     Download and execute shellcode from specified address    0x0B079F93  killprocess  Terminates the first process found specified by name    0x00006A34  cmd  Initiates a reverse shell to the C2 server    0x09C573C7  runplug  Plugin control    0x08CB69DE  autorun  Updates backdoor    Table 2: Supported Commands Configuration A configuration file resides in a file under the backdoor’s installation directory with the .bin extension