HALFBAKED

Halfbaked is a type of malware that can infect a computer system through suspicious downloads, emails, or websites. The shellcode of Halfbaked is designed to reattempt communication with the C2 server address in a specific pattern if it is initially unable to contact the server. Once inside a computer, Halfbaked drops several VBScripts and configuration files into a folder it creates by GUID name inside "Intel." These files include various payloads and configuration files that allow the malware to execute its functions. This variant of Halfbaked connects to three C2 servers and listens for various commands from the attacker, including sending victim machine information, taking screenshots, executing scripts and files, and deleting and updating specified files. All communication between the backdoor and the attacker's C2 are encoded using a specific technique. Halfbaked is a part of the Halfbaked malware family, which is designed to establish and maintain a foothold in victim networks and gain access to sensitive financial information. FireEye iSIGHT Intelligence MySIGHT Portal contains additional information regarding FIN7 and Halfbaked's investigations.