Overview

overview

10

Static

static

c7094e20cc...db.jar

windows7_x64

1

c7094e20cc...db.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c7094e20cc91b7c901d6eb5e31960adb.jar

  • Size

    166KB

  • Sample

    201005-yp3ys13gp6

  • MD5

    c7094e20cc91b7c901d6eb5e31960adb

  • SHA1

    90c51c785f4ce1e8c512a138f0f6ae0f91ea06e5

  • SHA256

    a1ef033975e130591e2621fb7e7b2c1d8ddb2472220892017247ef541da8de77

  • SHA512

    afbd1b6c0cc7d7ef062581a4390aac08b1b3612ba91a7dc0e46acc021ab1c8d8066e3e0fc1bec6932e5ed5a56ea0df2256999d88bd386a3519a157574e64c683

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      c7094e20cc91b7c901d6eb5e31960adb.jar

    • Size

      166KB

    • MD5

      c7094e20cc91b7c901d6eb5e31960adb

    • SHA1

      90c51c785f4ce1e8c512a138f0f6ae0f91ea06e5

    • SHA256

      a1ef033975e130591e2621fb7e7b2c1d8ddb2472220892017247ef541da8de77

    • SHA512

      afbd1b6c0cc7d7ef062581a4390aac08b1b3612ba91a7dc0e46acc021ab1c8d8066e3e0fc1bec6932e5ed5a56ea0df2256999d88bd386a3519a157574e64c683

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks