Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

fsdfas.jar

windows7_x64

1

fsdfas.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fsdfas.jar

  • Size

    68KB

  • Sample

    201026-e6273gex5j

  • MD5

    eeb9a3c4cc1fd0e95ff4184a50eb49d9

  • SHA1

    8445135ef24533a22270fd15d9a9e767c43168e6

  • SHA256

    6b9c4f7252046dbdc98d8eb537bdc776b1e35040b86c1dc1927c2e6bdd7e6c0d

  • SHA512

    8533d4d2ef1fbcf7df5c452f613606df19a6271a54c4114809c3dfb21a0900e9d58474ba39da63b4bbd7aec4ed15279b81a3fcf538560e8e6bcc92781866ebcd

Score
10/10
qnodeservicepersistencetrojan

Malware Config

Targets

    • Target

      fsdfas.jar

    • Size

      68KB

    • MD5

      eeb9a3c4cc1fd0e95ff4184a50eb49d9

    • SHA1

      8445135ef24533a22270fd15d9a9e767c43168e6

    • SHA256

      6b9c4f7252046dbdc98d8eb537bdc776b1e35040b86c1dc1927c2e6bdd7e6c0d

    • SHA512

      8533d4d2ef1fbcf7df5c452f613606df19a6271a54c4114809c3dfb21a0900e9d58474ba39da63b4bbd7aec4ed15279b81a3fcf538560e8e6bcc92781866ebcd

    Score
    10/10
    trojanqnodeservicepersistence

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks