Overview

overview

10

Static

static

DHL AWB.pdf.jar

windows7_x64

1

DHL AWB.pdf.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DHL AWB.pdf.jar

  • Size

    12KB

  • Sample

    200626-6z8jj7vefx

  • MD5

    8884e6fdb451ba445b40b41d99cfc162

  • SHA1

    fa3ec63c146dd38cd98b9f478bb26c9028ff36cf

  • SHA256

    732389d36893f1f46024d4a4fecc3881f1d913818a34b676782115ab89023697

  • SHA512

    c59ed8982e490314604c81f062dcccf6d8bc529ecad5bb03acdadfc0690f8f8e9aa3f9e5eb3e92f3af8998224e65d3c3045bfdf21cca86de35a34a1bbf16eddb

Score
10/10
qnodeservicepersistencespywaretrojan

Malware Config

Targets

    • Target

      DHL AWB.pdf.jar

    • Size

      12KB

    • MD5

      8884e6fdb451ba445b40b41d99cfc162

    • SHA1

      fa3ec63c146dd38cd98b9f478bb26c9028ff36cf

    • SHA256

      732389d36893f1f46024d4a4fecc3881f1d913818a34b676782115ab89023697

    • SHA512

      c59ed8982e490314604c81f062dcccf6d8bc529ecad5bb03acdadfc0690f8f8e9aa3f9e5eb3e92f3af8998224e65d3c3045bfdf21cca86de35a34a1bbf16eddb

    Score
    10/10
    persistencetrojanqnodeservicespyware

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks