Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    FiveMLoader.exe

  • Size

    3.3MB

  • MD5

    82b14cd1e11e29598a916c1b1629dfb0

  • SHA1

    7eb670d32bfb23e894a29855fe0a3af0eb7b0128

  • SHA256

    72f47823960b67a9fa387b26bfd4f4ab15d3580761d9b085fba7d87a8a57eb00

  • SHA512

    bf1239e3c84fdddf5740bd44150c83c243b77454048c59b7016f02644bfc9e60a692599d8352e9733342c7b00614e58a2f49b608935c870dd6c5b0bc109457bf

  • SSDEEP

    49152:Ivkt62XlaSFNWPjljiFa2RoUYIgjeEErH2k/uVfoGdiTHHB72eh2NT:Iv462XlaSFNWPjljiFXRoUYIgjegV

Score
10/10
office04quasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.117:4782

Mutex

aed85f86-48ab-42a4-b993-ef0b15015fa9

Attributes
  • encryption_key

    562EA3A3C512FD005246DCFBAFC590CAB953B6DB

  • install_name

    FiveMX.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    FiveMX Loader

  • subdirectory

    FiveMX

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • FiveMLoader.exe
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections