Dboxshell

DboxShell is a type of malware that uses cloud storage services as a command and control (C&C) mechanism. It is also known as PowerMagic by Kaspersky. This malicious software infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can disrupt operations, steal personal information, or even hold data for ransom. The malware was deployed in multiple operations, with variants used in OP#1 and OP#4. Upon execution of DBoxShell or its variant GraphShell, which was utilized in OP#5, the reconnaissance phase begins. This stage serves as an entry point for the attackers, allowing them to evaluate the potential interest of their targets. They use different tools during this phase to assess the value of the compromised system. In one instance, the attack involved a phishing email with a malicious attachment that downloaded a variant of DBoxShell malware onto the victim’s device. In a specific scenario, a .vbs file was found to be responsible for XORing and executing a .dat file, which contained a small loader and a variant of DBoxShell. After applying a conversion to the file, it was identified as DBoxShell. The cybersecurity firm Malwarebytes has studied this malware extensively, noting its unique utilization of cloud storage services for its C&C mechanism.