Overview

overview

10

Static

static

Q#5851042-...37.jar

windows7_x64

1

Q#5851042-...37.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Q#5851042-5811#914915-001 PO#340437.jar

  • Size

    12KB

  • Sample

    200702-pwz7qblyp2

  • MD5

    12d8527421ed9d8e2c02d7ef11840a38

  • SHA1

    2d98fd24f283b6f64929bf81814e736c534e5532

  • SHA256

    4f7e0ca7ff7f9079fa391eed25c8abaf5d3b86f5e64e143f1323e18a52c3ecfe

  • SHA512

    9bc5597f0425544cd3ed765892f2e6f8bfa00b1f86580559dbb220f72b10fea1594721cd1b711508ce5f6a109d45eb3b471ae4c518805c52cc0e64020b14d003

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      Q#5851042-5811#914915-001 PO#340437.jar

    • Size

      12KB

    • MD5

      12d8527421ed9d8e2c02d7ef11840a38

    • SHA1

      2d98fd24f283b6f64929bf81814e736c534e5532

    • SHA256

      4f7e0ca7ff7f9079fa391eed25c8abaf5d3b86f5e64e143f1323e18a52c3ecfe

    • SHA512

      9bc5597f0425544cd3ed765892f2e6f8bfa00b1f86580559dbb220f72b10fea1594721cd1b711508ce5f6a109d45eb3b471ae4c518805c52cc0e64020b14d003

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks