Overview

overview

10

Static

static

023abdf233...7f.jar

windows7_x64

1

023abdf233...7f.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    023abdf2337367286dfacb24c1083b7f.jar

  • Size

    278KB

  • Sample

    201005-ve5xetcwcn

  • MD5

    023abdf2337367286dfacb24c1083b7f

  • SHA1

    c2d901942b56d9f416e60f4a5e016b3cde322aba

  • SHA256

    b6b41f00daa713f98a2d89aae60de306688576cfe7e9186eb0d8e4821a6800b6

  • SHA512

    5e26091512925b28909b01c7aaabdd63f0c1f7a39461b5f450f2389dc4d6e26dc3e3d920035dccf10487afb8ad1ff6f99b272b5210be1a533ed56749c8e5a1e7

Score
10/10
qnodeservicepersistencespywaretrojan

Malware Config

Targets

    • Target

      023abdf2337367286dfacb24c1083b7f.jar

    • Size

      278KB

    • MD5

      023abdf2337367286dfacb24c1083b7f

    • SHA1

      c2d901942b56d9f416e60f4a5e016b3cde322aba

    • SHA256

      b6b41f00daa713f98a2d89aae60de306688576cfe7e9186eb0d8e4821a6800b6

    • SHA512

      5e26091512925b28909b01c7aaabdd63f0c1f7a39461b5f450f2389dc4d6e26dc3e3d920035dccf10487afb8ad1ff6f99b272b5210be1a533ed56749c8e5a1e7

    Score
    10/10
    persistencetrojanqnodeservicespyware

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks