General
-
Target
DOCUMENT.jar
-
Size
11KB
-
Sample
200707-6zt4cxrcya
-
MD5
5995a60cb5da5d0581926fc154ced6eb
-
SHA1
2b428a3f8f5c6d47e3cda97b0e62593a23c0a65a
-
SHA256
d598c592d48a490ec96d27cf4617c08908916d716e030eb0a7d79ba61d70d695
-
SHA512
6c595dc2183560043ababa811a60a42aa033b3eb414d1e79010e698d4126fe0eb78b879200c6fdcf92aec829de371883802d9078fec90e0bd9cc5d580656b31e
Static task
static1
Behavioral task
behavioral1
Sample
DOCUMENT.jar
Resource
win7v200430
Behavioral task
behavioral2
Sample
DOCUMENT.jar
Resource
win10
Malware Config
Targets
-
-
Target
DOCUMENT.jar
-
Size
11KB
-
MD5
5995a60cb5da5d0581926fc154ced6eb
-
SHA1
2b428a3f8f5c6d47e3cda97b0e62593a23c0a65a
-
SHA256
d598c592d48a490ec96d27cf4617c08908916d716e030eb0a7d79ba61d70d695
-
SHA512
6c595dc2183560043ababa811a60a42aa033b3eb414d1e79010e698d4126fe0eb78b879200c6fdcf92aec829de371883802d9078fec90e0bd9cc5d580656b31e
Score10/10-
QNodeService
is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.
-
QNodeService NodeJS Trojan
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run entry to start application
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-