Overview

overview

10

Static

static

Order01102020.jar

windows7_x64

1

Order01102020.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Order01102020.jar

  • Size

    220KB

  • Sample

    201005-ws4q3seylj

  • MD5

    b4c3a4f0d94f0d3232bdf5f8932a3f79

  • SHA1

    86585ca9dd7c692a25a1ec599c61e5a99109f869

  • SHA256

    f14e10f6af2f090a7228e52439fd49e91b5bfef954f9c8634bdd6c466a774739

  • SHA512

    3614df27639770e9edf097cd6a930e62d003d5e195cd122596c711c369e0aa15e1a48911b3642b10a5708d74b946f11a2e1db8734d81da598d966f7b63c6df2d

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      Order01102020.jar

    • Size

      220KB

    • MD5

      b4c3a4f0d94f0d3232bdf5f8932a3f79

    • SHA1

      86585ca9dd7c692a25a1ec599c61e5a99109f869

    • SHA256

      f14e10f6af2f090a7228e52439fd49e91b5bfef954f9c8634bdd6c466a774739

    • SHA512

      3614df27639770e9edf097cd6a930e62d003d5e195cd122596c711c369e0aa15e1a48911b3642b10a5708d74b946f11a2e1db8734d81da598d966f7b63c6df2d

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks