Overview

overview

10

Static

static

Payment Co...on.jar

windows7_x64

10

Payment Co...on.jar

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09/11/2020, 19:43 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Payment Confirmation.jar

  • Size

    100KB

  • MD5

    bcaa3de9152dfbc095f37bb67853770e

  • SHA1

    6c6fda231bbc79f6730b4e4ad2cf21b29d0d9e15

  • SHA256

    20629897fd36f8cdb5321d1c58b8acb62fa29c54c0e22b1d2e9e6bef807f7e4d

  • SHA512

    b6025ecc196a6930157ae6ae8aac5109b54ec404a3af96aa6652cce9858e30f7513769fdef5084082ad9dd5710563443c21d01988d5de2cda5583ebd8c341025

Score
10/10
qnodeservicetrojan

Malware Config

Signatures

  • QNodeService

    Trojan/stealer written in NodeJS and spread via Java downloader.

    trojanqnodeservice
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\ProgramData\Oracle\Java\javapath\java.exe
    java -jar "C:\Users\Admin\AppData\Local\Temp\Payment Confirmation.jar"
    1⤵
    • Suspicious use of SetWindowsHookEx
    PID:1160

Network

  • flag-unknown
    DNS
    nodejs.org
    Remote address:
    8.8.8.8:53
    Request
    nodejs.org
    IN A
    Response
    nodejs.org
    IN A
    104.20.22.46
    nodejs.org
    IN A
    104.20.23.46
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • flag-unknown
    DNS
    central.qhub.qua.one
    Remote address:
    8.8.8.8:53
    Request
    central.qhub.qua.one
    IN A
    Response
  • 104.20.22.46:443
    nodejs.org
    tls
    java.exe
    450.7kB
     29.0MB
     9785
    19410
  • 8.8.8.8:53
    nodejs.org
    dns
    56 B
     88 B
     1
    1

    DNS Request

    nodejs.org

    DNS Response

    104.20.22.46
    104.20.23.46

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

  • 8.8.8.8:53
    central.qhub.qua.one
    dns
    66 B
     133 B
     1
    1

    DNS Request

    central.qhub.qua.one

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.