Overview

overview

10

Static

static

order inquiry.jar

windows7_x64

1

order inquiry.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    order inquiry.jar

  • Size

    13KB

  • Sample

    200702-cs44gqksqs

  • MD5

    c1dae1cfd76817255cb7836927d6c85b

  • SHA1

    2b9d4d3f6d0d599cff72f721f845278a2b791d27

  • SHA256

    82785f7db62e9cabf47231d0fe34699459c74ec9d1386f09f97254465c4ce1cd

  • SHA512

    6c0cb3476d25c497f9cae09a5fb27014ebabd8a860203b8867cf027fea466212e4af0d5c9058d9cb16cbd05c6b78b092f15982de40673c997871ce5b6aee3d84

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      order inquiry.jar

    • Size

      13KB

    • MD5

      c1dae1cfd76817255cb7836927d6c85b

    • SHA1

      2b9d4d3f6d0d599cff72f721f845278a2b791d27

    • SHA256

      82785f7db62e9cabf47231d0fe34699459c74ec9d1386f09f97254465c4ce1cd

    • SHA512

      6c0cb3476d25c497f9cae09a5fb27014ebabd8a860203b8867cf027fea466212e4af0d5c9058d9cb16cbd05c6b78b092f15982de40673c997871ce5b6aee3d84

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks