Overview

overview

10

Static

static

CD Order 82300.jar

windows7_x64

1

CD Order 82300.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    CD Order 82300.jar

  • Size

    74KB

  • Sample

    201023-8ew6t7dthn

  • MD5

    818d4e622ada384e3d7b2559e8143ed9

  • SHA1

    83ba200f8f7cd26adacc4598a32dbb366f57a890

  • SHA256

    16ae20e84040cff111b7c11b0b56d495f2ce483bf3b8a5cd71a3b46103f71491

  • SHA512

    8092f09c7138aa32dbe1d02d2c050edeb1eeaa2c933c706827dfef17bd9d4904f81c221a14e3a60f4519e76b8bfe9a602a2284053559e2f2867f419b76cdfbff

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      CD Order 82300.jar

    • Size

      74KB

    • MD5

      818d4e622ada384e3d7b2559e8143ed9

    • SHA1

      83ba200f8f7cd26adacc4598a32dbb366f57a890

    • SHA256

      16ae20e84040cff111b7c11b0b56d495f2ce483bf3b8a5cd71a3b46103f71491

    • SHA512

      8092f09c7138aa32dbe1d02d2c050edeb1eeaa2c933c706827dfef17bd9d4904f81c221a14e3a60f4519e76b8bfe9a602a2284053559e2f2867f419b76cdfbff

    Score
    10/10
    trojanqnodeservicepersistence

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks