Overview

overview

10

Static

static

Ref Swift ...df.jar

windows7_x64

1

Ref Swift ...df.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ref Swift Amount.pdf.jar

  • Size

    13KB

  • Sample

    200705-n41cjhcn3j

  • MD5

    0116bbe99adfdb7f0e2c6e1fefe10642

  • SHA1

    c8208c0da417f08fc5d60b426cb3e9c68de3bdc3

  • SHA256

    a002f82ab804aa9976005619bc75c26345006c67a454b39fe0e404a14af7f705

  • SHA512

    bccb6c0146f19fa26c5cf721c19c8a7e9f4925614f3528dea73c181c1f1ed0043c440d0b26a73779e3dd8e117bb01c6996fe2c0db69445fae379f41c485cff6b

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      Ref Swift Amount.pdf.jar

    • Size

      13KB

    • MD5

      0116bbe99adfdb7f0e2c6e1fefe10642

    • SHA1

      c8208c0da417f08fc5d60b426cb3e9c68de3bdc3

    • SHA256

      a002f82ab804aa9976005619bc75c26345006c67a454b39fe0e404a14af7f705

    • SHA512

      bccb6c0146f19fa26c5cf721c19c8a7e9f4925614f3528dea73c181c1f1ed0043c440d0b26a73779e3dd8e117bb01c6996fe2c0db69445fae379f41c485cff6b

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks