Overview

overview

10

Static

static

99dcdadfee...85.jar

windows7_x64

1

99dcdadfee...85.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    99dcdadfeed1b6271637cd158eddc785.jar

  • Size

    11KB

  • Sample

    200706-lbhkgxdc22

  • MD5

    99dcdadfeed1b6271637cd158eddc785

  • SHA1

    4420bd2bb41db133243192337ff37a1b9a34414a

  • SHA256

    f0e9d3a5162ecadf7a48a64603e0d813ed45ff53882e63251e3f3c7c5a2e408b

  • SHA512

    4ca54d207a9ee57d14edd00d195bd2264443e2242fc6dce31eac2a2f0a33ce3d88e208819ef53aac874df6d52edbd041dde532f4a6266379ca7d7ea275f0126f

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      99dcdadfeed1b6271637cd158eddc785.jar

    • Size

      11KB

    • MD5

      99dcdadfeed1b6271637cd158eddc785

    • SHA1

      4420bd2bb41db133243192337ff37a1b9a34414a

    • SHA256

      f0e9d3a5162ecadf7a48a64603e0d813ed45ff53882e63251e3f3c7c5a2e408b

    • SHA512

      4ca54d207a9ee57d14edd00d195bd2264443e2242fc6dce31eac2a2f0a33ce3d88e208819ef53aac874df6d52edbd041dde532f4a6266379ca7d7ea275f0126f

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks