Overview

overview

10

Static

static

payment.jar

windows7_x64

1

payment.jar

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    payment.jar

  • Size

    65KB

  • Sample

    201105-54n2qmz7qe

  • MD5

    493b0bef6259b1e451e304e68164c891

  • SHA1

    a20d3ab73bafde4d7818cea9fd22de3d83072c91

  • SHA256

    7dabb16da3b6b7a4a98f02a852d0d6d46b11a2c60fec5749a234368e2204c8fc

  • SHA512

    1a300670283431ab5347dc05057d48a2736cd0119466e96a7fd15a75d451a454bc7446d15423c3362d889d006787ac93709b3e2a37acb7daf24de38d07785e40

Score
10/10
qnodeservicepersistencespywaretrojan

Malware Config

Targets

    • Target

      payment.jar

    • Size

      65KB

    • MD5

      493b0bef6259b1e451e304e68164c891

    • SHA1

      a20d3ab73bafde4d7818cea9fd22de3d83072c91

    • SHA256

      7dabb16da3b6b7a4a98f02a852d0d6d46b11a2c60fec5749a234368e2204c8fc

    • SHA512

      1a300670283431ab5347dc05057d48a2736cd0119466e96a7fd15a75d451a454bc7446d15423c3362d889d006787ac93709b3e2a37acb7daf24de38d07785e40

    Score
    10/10
    qnodeservicepersistencespywaretrojan

    • QNodeService

      Trojan/stealer written in NodeJS and spread via Java downloader.

      trojanqnodeservice

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spyware

    • Adds Run key to start application

      persistence

    • JavaScript code in executable

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks