Overview

overview

10

Static

static

frozen Fis...tc.jar

windows7_x64

1

frozen Fis...tc.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    frozen Fish, Shirmp,Pacific mackerel,Sardine,Round scad,lllex Squidetc.jar

  • Size

    12KB

  • Sample

    200722-gbcs3bznkx

  • MD5

    4420ae767b10155e152a90ea65cc661e

  • SHA1

    2a9878979c046b48b8d19c051a9b09295baa604b

  • SHA256

    c79fac5b4dac72d91fca7d4b8ac2c6a01182f785765135b7a237530cdc6cbffa

  • SHA512

    911e067cffd455d5ad35225957c3cc2a3931ed389fe949a8c2a1041dfe98a3c71d08e4c1677624af89fd3120b37074f045372ada9ba5e19bf866b6800f179611

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      frozen Fish, Shirmp,Pacific mackerel,Sardine,Round scad,lllex Squidetc.jar

    • Size

      12KB

    • MD5

      4420ae767b10155e152a90ea65cc661e

    • SHA1

      2a9878979c046b48b8d19c051a9b09295baa604b

    • SHA256

      c79fac5b4dac72d91fca7d4b8ac2c6a01182f785765135b7a237530cdc6cbffa

    • SHA512

      911e067cffd455d5ad35225957c3cc2a3931ed389fe949a8c2a1041dfe98a3c71d08e4c1677624af89fd3120b37074f045372ada9ba5e19bf866b6800f179611

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      is a trojan written in NodeJS and spread via Java downloader. Utilizes stealer functionality.

      trojanqnodeservice

    • QNodeService NodeJS Trojan

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks