Overview

overview

10

Static

static

Global IGT...16.jar

windows7_x64

1

Global IGT...16.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Global IGT Order Confirmation - 50663316.jar

  • Size

    65KB

  • Sample

    201023-ybsmz8d75s

  • MD5

    33c8d27194952f06b3513fc1f1d7b0b0

  • SHA1

    2efe7db22396815c67b35343d19dfaae823cc6ed

  • SHA256

    ada58686c1ceb582ffb4285be9b393d9ccb48cf32bbc832bd91041fdd520ca99

  • SHA512

    a3b5b0dd4b6ee11246d2e907507c6b5e3c027364d1d47bb2ce1a6e78cbe32579c0ee4b786f3934d1bbcb08795b048b99aa638aad745bee0d183d547c8a5474c2

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      Global IGT Order Confirmation - 50663316.jar

    • Size

      65KB

    • MD5

      33c8d27194952f06b3513fc1f1d7b0b0

    • SHA1

      2efe7db22396815c67b35343d19dfaae823cc6ed

    • SHA256

      ada58686c1ceb582ffb4285be9b393d9ccb48cf32bbc832bd91041fdd520ca99

    • SHA512

      a3b5b0dd4b6ee11246d2e907507c6b5e3c027364d1d47bb2ce1a6e78cbe32579c0ee4b786f3934d1bbcb08795b048b99aa638aad745bee0d183d547c8a5474c2

    Score
    10/10
    trojanqnodeservicepersistence

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks