Comnie 05062018


        
            
                Markdown 0.83 KB
                                    
                        | None                    
                
                                        |
    0    0                            

            
                
                                    raw
                    download
                    clone
                    embed
                    print
                
                                    report
                
                                    
                        diff                    
                
                            
        
        
            [Comnie 05062018]
https://app.any.run/tasks/e9a9a5a8-185b-42a3-a756-79d68d814e2e
[Background info]
https://researchcenter.paloaltonetworks.com/2018/01/unit42-comnie-continues-target-organizations-east-asia/
[Comnie C2]
https://gosparklyfan.tumblr.com/

https://sosswi2009.wordpress.com/

http://115.144.238.40:8080/NgAqPxDsEdDlVmUtCgEsCgWt.asp?pid=/F4jo40t3N9/g4+zP2Ceuy7BdchyPP==    
[Comnie persistence]
LNK

CommandLineArguments:   "C:\Users\admin\AppData\Local\Temp\proxyconf.dll",Sd

WorkingDirectory:   C:\Users\admin\AppData\Local\Temp

RelativePath:   ..................\Windows\system32\rundll32.exe

Description:    Conime