Overview

overview

10

Static

static

payment 45...ro.jar

windows7_x64

1

payment 45...ro.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment 45.450,20 Euro.jar

  • Size

    12KB

  • Sample

    200702-1cchdtwayj

  • MD5

    070253aecc9cd3441285bd1a5710b62e

  • SHA1

    05c90b7a18329fe99956913dfed535ebe5503bf7

  • SHA256

    62716017ffcc1ef7fc4923eeb3d0df2e8c5dfde0e195eb4ef2aa4673f83f20a2

  • SHA512

    40145524b698fc72d8fa4b7b10fd3a554a941bcff0a116484eda7ed290474bda6409812196f96b7b25c857c2625db10e7e5874a25b2375a7f102aa3dc7132b26

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      payment 45.450,20 Euro.jar

    • Size

      12KB

    • MD5

      070253aecc9cd3441285bd1a5710b62e

    • SHA1

      05c90b7a18329fe99956913dfed535ebe5503bf7

    • SHA256

      62716017ffcc1ef7fc4923eeb3d0df2e8c5dfde0e195eb4ef2aa4673f83f20a2

    • SHA512

      40145524b698fc72d8fa4b7b10fd3a554a941bcff0a116484eda7ed290474bda6409812196f96b7b25c857c2625db10e7e5874a25b2375a7f102aa3dc7132b26

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks