Procedure examples

BoomBox can encrypt data using AES prior to exfiltration.

BoomBox can enumerate the username on a compromised host.

BoomBox has the ability to mask malicious data strings as PDF files.

BoomBox has used HTTP POST requests for C2.

BoomBox can enumerate the hostname, domain, and IP of a compromised host.

BoomBox can search for specific files and directories on a machine.

BoomBox has the ability to execute an LDAP query to enumerate the distinguished name, SAM account name, and display name for all domain users.

BoomBox can execute an LDAP query to discover e-mail accounts for domain users.

BoomBox can download files from Dropbox using a hardcoded access token.

BoomBox has the ability to download next stage malware components to a compromised system.

BoomBox can decrypt AES-encrypted files downloaded from C2.

BoomBox has gained execution through user interaction with a malicious file.

BoomBox can use RunDLL32 for execution.

BoomBox can check its current working directory and for the presence of a specific file and terminate if specific values are not found.

BoomBox can establish persistence by writing the Registry value MicroNativeCacheSvc to HKCU\Software\Microsoft\Windows\CurrentVersion\Run.

BoomBox can upload data to dedicated per-victim folders in Dropbox.