Overview

overview

10

Static

static

UPS_AD1230...9D.jar

windows7_x64

1

UPS_AD1230...9D.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    UPS_AD12300AW_1290499D.jar

  • Size

    77KB

  • Sample

    201023-g17f9e5mze

  • MD5

    53c0c382644adebe67a8af12d50cd35e

  • SHA1

    8850f62e32c9f89bd4dc4ae419ef51b4b3009207

  • SHA256

    c882fc449cd0ca0348938fec76bd0200a3aeadb6d874728b5f15ade967c72c17

  • SHA512

    57f9c30622c671348dd683a423ed5c69cee8d61873c1b14c3207641a990fd8712198feb5204d940b7c52c11586d9af60cc066e1af5a133c7f4dcbc0a10198aa4

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      UPS_AD12300AW_1290499D.jar

    • Size

      77KB

    • MD5

      53c0c382644adebe67a8af12d50cd35e

    • SHA1

      8850f62e32c9f89bd4dc4ae419ef51b4b3009207

    • SHA256

      c882fc449cd0ca0348938fec76bd0200a3aeadb6d874728b5f15ade967c72c17

    • SHA512

      57f9c30622c671348dd683a423ed5c69cee8d61873c1b14c3207641a990fd8712198feb5204d940b7c52c11586d9af60cc066e1af5a133c7f4dcbc0a10198aa4

    Score
    10/10
    trojanqnodeservicepersistence

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks