Overview

overview

10

Static

static

Invoice FV...on.jar

windows7_x64

1

Invoice FV...on.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice FVF-33620200711 Payment confirmation.jar

  • Size

    12KB

  • Sample

    200722-2dqvf8ayjj

  • MD5

    5ad9084d4c1eb71401e72628e5f6c0be

  • SHA1

    0487680ad4c77db95ffd7178c790a5f0c0ebf2b7

  • SHA256

    1ed58cab0503e46cb79ba34561c543135dab8969d7d82685573797699a0b7b7d

  • SHA512

    2500f55d3419067b61f0f53d7ca8e04b22c109c6c81bea2281371467b171f66168eb9723f713152b294d651955df2cb0267bb42ec6ead5573864c5e515800d59

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      Invoice FVF-33620200711 Payment confirmation.jar

    • Size

      12KB

    • MD5

      5ad9084d4c1eb71401e72628e5f6c0be

    • SHA1

      0487680ad4c77db95ffd7178c790a5f0c0ebf2b7

    • SHA256

      1ed58cab0503e46cb79ba34561c543135dab8969d7d82685573797699a0b7b7d

    • SHA512

      2500f55d3419067b61f0f53d7ca8e04b22c109c6c81bea2281371467b171f66168eb9723f713152b294d651955df2cb0267bb42ec6ead5573864c5e515800d59

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks