Overview

overview

10

Static

static

Purchase Order.jar

windows7_x64

1

Purchase Order.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Purchase Order.jar

  • Size

    176KB

  • Sample

    201015-k3ensada8n

  • MD5

    1a15d0e4ad08675860fe1e7a9ad07cee

  • SHA1

    30643b426d982fad93079edde3402e8e5e80bc3e

  • SHA256

    b6ac632bb94c55ecc3aeb2b04c16c5fa3b50792a8379447cf9fcce12477791ba

  • SHA512

    29e89a458abca9cc549f1dee8231c4ed5ae4085018c52c0d7274e0efd7f0c58f816b3bd0b74035ee99d2df7f83e7067b76603de8f6f5f747f6c561a2481dcdc9

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      Purchase Order.jar

    • Size

      176KB

    • MD5

      1a15d0e4ad08675860fe1e7a9ad07cee

    • SHA1

      30643b426d982fad93079edde3402e8e5e80bc3e

    • SHA256

      b6ac632bb94c55ecc3aeb2b04c16c5fa3b50792a8379447cf9fcce12477791ba

    • SHA512

      29e89a458abca9cc549f1dee8231c4ed5ae4085018c52c0d7274e0efd7f0c58f816b3bd0b74035ee99d2df7f83e7067b76603de8f6f5f747f6c561a2481dcdc9

    Score
    10/10
    persistencetrojanqnodeservice

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks