Description
Trojan/stealer written in NodeJS and spread via Java downloader.
shipment.update.jar
General
Target
Size
Sample
shipment.update.jar
78KB
201111-rt9zdfp56s
Score
10 /10
MD5
SHA1
SHA256
SHA512
1d87978aca22f2aea87760aa9740a5bd
ca32d5b571f1622cae00343a69989b1970ac5724
a0c8dec14afed290247144699853de8c2cc21bbb71e057182f219b771325ec20
92197ea9e746b2a0c3ba13190da78fefe42f4eb6016ef5479d88a050b7fe8baf23485ca2d484493224c7b463d964a32657e1fede565910118eb48fee710cdf1c
Malware Config
Targets
Target
MD5
Filesize
shipment.update.jar
1d87978aca22f2aea87760aa9740a5bd
78KB
Score
10/10
SHA1
SHA256
SHA512
ca32d5b571f1622cae00343a69989b1970ac5724
a0c8dec14afed290247144699853de8c2cc21bbb71e057182f219b771325ec20
92197ea9e746b2a0c3ba13190da78fefe42f4eb6016ef5479d88a050b7fe8baf23485ca2d484493224c7b463d964a32657e1fede565910118eb48fee710cdf1c
Tags
Signatures
-
QNodeService
-
Executes dropped EXE
-
Adds Run key to start application
Tags
TTPs
-
JavaScript code in executable
-
Looks up external IP address via web service
Description
Uses a legitimate IP lookup service to find the infected system's external IP.
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Tasks