Overview

overview

10

Static

static

list of eq...df.jar

windows7_x64

1

list of eq...df.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    list of equipment_puma_pdf.jar

  • Size

    258KB

  • Sample

    201005-djf6l11372

  • MD5

    9d5548aa1a52a4fd8cc9ad1c64a23a09

  • SHA1

    72474bd84027c0aa72b09c3f48e1c57ecf935bb2

  • SHA256

    0d7b48039793c6f044e4d7b6f42898adbe1e9d722ec37a12c7073cdfffa63db6

  • SHA512

    c73296d0b6cd972a90eef0e7a4c32874cf190cf2d545f2f1338ce2d3bf7dfc784a46bf514be6b7d2ebb92124e610c86667a53f7d3ebe5c31a5791a6ef8e90eb6

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      list of equipment_puma_pdf.jar

    • Size

      258KB

    • MD5

      9d5548aa1a52a4fd8cc9ad1c64a23a09

    • SHA1

      72474bd84027c0aa72b09c3f48e1c57ecf935bb2

    • SHA256

      0d7b48039793c6f044e4d7b6f42898adbe1e9d722ec37a12c7073cdfffa63db6

    • SHA512

      c73296d0b6cd972a90eef0e7a4c32874cf190cf2d545f2f1338ce2d3bf7dfc784a46bf514be6b7d2ebb92124e610c86667a53f7d3ebe5c31a5791a6ef8e90eb6

    Score
    10/10
    trojanqnodeservicepersistence

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks