Overview

overview

10

Static

static

DOCUMENT.jar

windows7_x64

1

DOCUMENT.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DOCUMENT.jar

  • Size

    11KB

  • Sample

    200707-6zt4cxrcya

  • MD5

    5995a60cb5da5d0581926fc154ced6eb

  • SHA1

    2b428a3f8f5c6d47e3cda97b0e62593a23c0a65a

  • SHA256

    d598c592d48a490ec96d27cf4617c08908916d716e030eb0a7d79ba61d70d695

  • SHA512

    6c595dc2183560043ababa811a60a42aa033b3eb414d1e79010e698d4126fe0eb78b879200c6fdcf92aec829de371883802d9078fec90e0bd9cc5d580656b31e

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      DOCUMENT.jar

    • Size

      11KB

    • MD5

      5995a60cb5da5d0581926fc154ced6eb

    • SHA1

      2b428a3f8f5c6d47e3cda97b0e62593a23c0a65a

    • SHA256

      d598c592d48a490ec96d27cf4617c08908916d716e030eb0a7d79ba61d70d695

    • SHA512

      6c595dc2183560043ababa811a60a42aa033b3eb414d1e79010e698d4126fe0eb78b879200c6fdcf92aec829de371883802d9078fec90e0bd9cc5d580656b31e

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run entry to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks