Overview

overview

10

Static

static

7a3e76834b...bf.jar

windows7_x64

1

7a3e76834b...bf.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7a3e76834b35ee6af8e613d5c36702bf.jar

  • Size

    480KB

  • Sample

    201005-892yq52yws

  • MD5

    7a3e76834b35ee6af8e613d5c36702bf

  • SHA1

    a9d778572c8e1781b538c52cadad10ccea997213

  • SHA256

    f0ac0142e6219a8f63b31bdf40f88f7cd0a2ebfcd111a581e0d5d48f6d9c4781

  • SHA512

    828f83b211bd00852bf430d465e8754690c14944a9697389953954bede19095926e6bfe3a273c7478de277063c83601881b602682f844674fd6bbd50eee6b827

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      7a3e76834b35ee6af8e613d5c36702bf.jar

    • Size

      480KB

    • MD5

      7a3e76834b35ee6af8e613d5c36702bf

    • SHA1

      a9d778572c8e1781b538c52cadad10ccea997213

    • SHA256

      f0ac0142e6219a8f63b31bdf40f88f7cd0a2ebfcd111a581e0d5d48f6d9c4781

    • SHA512

      828f83b211bd00852bf430d465e8754690c14944a9697389953954bede19095926e6bfe3a273c7478de277063c83601881b602682f844674fd6bbd50eee6b827

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks