Play interactive tour

Edit tour

Analysis Report FacebookSecurityUpdate.exe

Overview

General Information

Sample Name:	FacebookSecurityUpdate.exe
Analysis ID:	397328
MD5:	ac46ae63e68b470fc8fc80f6a74e7964
SHA1:	373a2d73c34c905b2a52257ed5d432f82e412fd7
SHA256:	1b12a22d5d562b59030df4697c4157a23766d0b34f9bd17a0ca7374e5a53e28c
Infos:
Most interesting Screenshot:

Detection

Quasar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Quasar RAT

.NET source code contains very large array initializations

.NET source code references suspicious native API functions

C2 URLs / IPs found in malware configuration

Connects to many ports of the same IP (likely port scanning)

Contains functionality to disable the Task Manager (.Net Source)

Creates autorun.inf (USB autostart)

Deletes shadow drive data (may be related to ransomware)

Drops executables to the windows directory (C:\Windows) and starts them

Hides that the sample has been downloaded from the Internet (zone.identifier)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

May check the online IP address of the machine

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains strange resources

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Startup

System is w10x64

FacebookSecurityUpdate.exe (PID: 5640 cmdline: 'C:\Users\user\Desktop\FacebookSecurityUpdate.exe' MD5: AC46AE63E68B470FC8FC80F6A74E7964)

FacebookSecurityUpdate.exe (PID: 5648 cmdline: 'C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe' MD5: 269E261FDBD4A955CB4591A39F3E08F4)

schtasks.exe (PID: 2644 cmdline: 'schtasks' /create /tn 'FacebookSecurityUpdate' /sc ONLOGON /tr 'C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe' /rl HIGHEST /f MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

FacebookSecurityUpdate.exe (PID: 6124 cmdline: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe MD5: 269E261FDBD4A955CB4591A39F3E08F4)

schtasks.exe (PID: 580 cmdline: 'schtasks' /create /tn 'FacebookSecurityUpdate' /sc ONLOGON /tr 'C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe' /rl HIGHEST /f MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 5856 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

FacebookSecurityUpdate.exe (PID: 3348 cmdline: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe MD5: 269E261FDBD4A955CB4591A39F3E08F4)

cleanup

Malware Configuration

Threatname: Quasar

{"Version": "1.4.0.0", "Host:Port": "84.38.133.101:14782;", "SubDirectory": "FacebookSecurityUpdate", "InstallName": "#za6H\"om,", "MutexName": "EhJ5YrFqRiwpbh4NdP", "StartupKey": "FacebookSecurityUpdate", "Tag": "SecurityHealthServices-WinRar", "LogDirectoryName": "Logs"}

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000002.00000002.202794643.0000000000D92000.00000002.00020000.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35cd7:$s1: DoUploadAndExecute 0x35ee5:$s2: DoDownloadAndExecute 0x35adb:$s3: DoShellExecute 0x35eaa:$s4: set_Processname 0x69c8:$op1: 04 1E FE 02 04 16 FE 01 60 0x68ec:$op2: 00 17 03 1F 20 17 19 15 28 0x7352:$op3: 00 04 03 69 91 1B 40 0x7ba2:$op3: 00 04 03 69 91 1B 40
00000002.00000002.202794643.0000000000D92000.00000002.00020000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35cd7:$s1: DoUploadAndExecute 0x35ee5:$s2: DoDownloadAndExecute 0x35adb:$s3: DoShellExecute 0x35eaa:$s4: set_Processname 0x69c8:$op1: 04 1E FE 02 04 16 FE 01 60 0x68ec:$op2: 00 17 03 1F 20 17 19 15 28 0x7352:$op3: 00 04 03 69 91 1B 40 0x7ba2:$op3: 00 04 03 69 91 1B 40
00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x3624f:$s1: DoUploadAndExecute 0x8f097:$s1: DoUploadAndExecute 0xe7ecf:$s1: DoUploadAndExecute 0x3645d:$s2: DoDownloadAndExecute 0x8f2a5:$s2: DoDownloadAndExecute 0xe80dd:$s2: DoDownloadAndExecute 0x36053:$s3: DoShellExecute 0x8ee9b:$s3: DoShellExecute 0xe7cd3:$s3: DoShellExecute 0x36422:$s4: set_Processname 0x8f26a:$s4: set_Processname 0xe80a2:$s4: set_Processname 0x6f40:$op1: 04 1E FE 02 04 16 FE 01 60 0x5fd88:$op1: 04 1E FE 02 04 16 FE 01 60 0xb8bc0:$op1: 04 1E FE 02 04 16 FE 01 60 0x6e64:$op2: 00 17 03 1F 20 17 19 15 28 0x5fcac:$op2: 00 17 03 1F 20 17 19 15 28 0xb8ae4:$op2: 00 17 03 1F 20 17 19 15 28 0x78ca:$op3: 00 04 03 69 91 1B 40 0x811a:$op3: 00 04 03 69 91 1B 40 0x60712:$op3: 00 04 03 69 91 1B 40
00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000002.00000000.193556825.0000000000D92000.00000002.00020000.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35cd7:$s1: DoUploadAndExecute 0x35ee5:$s2: DoDownloadAndExecute 0x35adb:$s3: DoShellExecute 0x35eaa:$s4: set_Processname 0x69c8:$op1: 04 1E FE 02 04 16 FE 01 60 0x68ec:$op2: 00 17 03 1F 20 17 19 15 28 0x7352:$op3: 00 04 03 69 91 1B 40 0x7ba2:$op3: 00 04 03 69 91 1B 40
00000002.00000000.193556825.0000000000D92000.00000002.00020000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000006.00000002.211316911.0000000000182000.00000002.00020000.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35cd7:$s1: DoUploadAndExecute 0x35ee5:$s2: DoDownloadAndExecute 0x35adb:$s3: DoShellExecute 0x35eaa:$s4: set_Processname 0x69c8:$op1: 04 1E FE 02 04 16 FE 01 60 0x68ec:$op2: 00 17 03 1F 20 17 19 15 28 0x7352:$op3: 00 04 03 69 91 1B 40 0x7ba2:$op3: 00 04 03 69 91 1B 40
00000006.00000002.211316911.0000000000182000.00000002.00020000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000002.457267428.0000000000602000.00000002.00020000.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35cd7:$s1: DoUploadAndExecute 0x35ee5:$s2: DoDownloadAndExecute 0x35adb:$s3: DoShellExecute 0x35eaa:$s4: set_Processname 0x69c8:$op1: 04 1E FE 02 04 16 FE 01 60 0x68ec:$op2: 00 17 03 1F 20 17 19 15 28 0x7352:$op3: 00 04 03 69 91 1B 40 0x7ba2:$op3: 00 04 03 69 91 1B 40
00000005.00000002.457267428.0000000000602000.00000002.00020000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000005.00000000.202485476.0000000000602000.00000002.00020000.sdmp	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35cd7:$s1: DoUploadAndExecute 0x35ee5:$s2: DoDownloadAndExecute 0x35adb:$s3: DoShellExecute 0x35eaa:$s4: set_Processname 0x69c8:$op1: 04 1E FE 02 04 16 FE 01 60 0x68ec:$op2: 00 17 03 1F 20 17 19 15 28 0x7352:$op3: 00 04 03 69 91 1B 40 0x7ba2:$op3: 00 04 03 69 91 1B 40
00000005.00000000.202485476.0000000000602000.00000002.00020000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: FacebookSecurityUpdate.exe PID: 6124	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: FacebookSecurityUpdate.exe PID: 5648	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: FacebookSecurityUpdate.exe PID: 5640	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: FacebookSecurityUpdate.exe PID: 3348	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
6.0.FacebookSecurityUpdate.exe.180000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
6.0.FacebookSecurityUpdate.exe.180000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
6.0.FacebookSecurityUpdate.exe.180000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
6.0.FacebookSecurityUpdate.exe.180000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
6.0.FacebookSecurityUpdate.exe.180000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
6.0.FacebookSecurityUpdate.exe.180000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
6.0.FacebookSecurityUpdate.exe.180000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x34b7a:$x3: GetKeyloggerLogsResponse 0x33e51:$x4: GetKeyloggerLogs 0x340ea:$s1: <RunHidden>k__BackingField 0x34d42:$s2: set_SystemInfos 0x34113:$s3: set_RunHidden 0x33ca6:$s4: set_RemotePath 0x2eb71:$s7: xClient.Core.ReverseProxy.Packets
0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2d983:$x4: xClient.Properties.Resources.resources 0x2d821:$s4: Client.exe 0x34113:$s7: set_RunHidden
0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x340d7:$s1: DoUploadAndExecute 0x342e5:$s2: DoDownloadAndExecute 0x33edb:$s3: DoShellExecute 0x342aa:$s4: set_Processname 0x4dc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x4cec:$op2: 00 17 03 1F 20 17 19 15 28 0x5752:$op3: 00 04 03 69 91 1B 40 0x5fa2:$op3: 00 04 03 69 91 1B 40
0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x34b7a:$x1: GetKeyloggerLogsResponse 0x34dba:$s1: DoShellExecuteResponse 0x34733:$s2: GetPasswordsResponse 0x34c8d:$s3: GetStartupItemsResponse 0x340eb:$s5: RunHidden 0x34109:$s5: RunHidden 0x34117:$s5: RunHidden 0x3412b:$s5: RunHidden
0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x3e31d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x3e4ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x407e5:$x2: Process already elevated. 0x324a0:$x4: get_encryptedPassword 0x342e5:$x5: DoDownloadAndExecute
0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x34b7a:$x3: GetKeyloggerLogsResponse 0x33e51:$x4: GetKeyloggerLogs 0x340ea:$s1: <RunHidden>k__BackingField 0x34d42:$s2: set_SystemInfos 0x34113:$s3: set_RunHidden 0x33ca6:$s4: set_RemotePath 0x2eb71:$s7: xClient.Core.ReverseProxy.Packets
0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2d983:$x4: xClient.Properties.Resources.resources 0x2d821:$s4: Client.exe 0x34113:$s7: set_RunHidden
0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x340d7:$s1: DoUploadAndExecute 0x342e5:$s2: DoDownloadAndExecute 0x33edb:$s3: DoShellExecute 0x342aa:$s4: set_Processname 0x4dc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x4cec:$op2: 00 17 03 1F 20 17 19 15 28 0x5752:$op3: 00 04 03 69 91 1B 40 0x5fa2:$op3: 00 04 03 69 91 1B 40
0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x34b7a:$x1: GetKeyloggerLogsResponse 0x34dba:$s1: DoShellExecuteResponse 0x34733:$s2: GetPasswordsResponse 0x34c8d:$s3: GetStartupItemsResponse 0x340eb:$s5: RunHidden 0x34109:$s5: RunHidden 0x34117:$s5: RunHidden 0x3412b:$s5: RunHidden
0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x3e31d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x3e4ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x407e5:$x2: Process already elevated. 0x324a0:$x4: get_encryptedPassword 0x342e5:$x5: DoDownloadAndExecute
0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
6.2.FacebookSecurityUpdate.exe.180000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
6.2.FacebookSecurityUpdate.exe.180000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
6.2.FacebookSecurityUpdate.exe.180000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
6.2.FacebookSecurityUpdate.exe.180000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
6.2.FacebookSecurityUpdate.exe.180000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
6.2.FacebookSecurityUpdate.exe.180000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
6.2.FacebookSecurityUpdate.exe.180000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
5.0.FacebookSecurityUpdate.exe.600000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
2.0.FacebookSecurityUpdate.exe.d90000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
5.0.FacebookSecurityUpdate.exe.600000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
5.0.FacebookSecurityUpdate.exe.600000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
5.0.FacebookSecurityUpdate.exe.600000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
5.0.FacebookSecurityUpdate.exe.600000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
5.0.FacebookSecurityUpdate.exe.600000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
2.0.FacebookSecurityUpdate.exe.d90000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
5.0.FacebookSecurityUpdate.exe.600000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
2.0.FacebookSecurityUpdate.exe.d90000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
2.0.FacebookSecurityUpdate.exe.d90000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
2.0.FacebookSecurityUpdate.exe.d90000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
2.0.FacebookSecurityUpdate.exe.d90000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
2.0.FacebookSecurityUpdate.exe.d90000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x34b7a:$x3: GetKeyloggerLogsResponse 0x33e51:$x4: GetKeyloggerLogs 0x340ea:$s1: <RunHidden>k__BackingField 0x34d42:$s2: set_SystemInfos 0x34113:$s3: set_RunHidden 0x33ca6:$s4: set_RemotePath 0x2eb71:$s7: xClient.Core.ReverseProxy.Packets
0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2d983:$x4: xClient.Properties.Resources.resources 0x2d821:$s4: Client.exe 0x34113:$s7: set_RunHidden
0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x340d7:$s1: DoUploadAndExecute 0x342e5:$s2: DoDownloadAndExecute 0x33edb:$s3: DoShellExecute 0x342aa:$s4: set_Processname 0x4dc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x4cec:$op2: 00 17 03 1F 20 17 19 15 28 0x5752:$op3: 00 04 03 69 91 1B 40 0x5fa2:$op3: 00 04 03 69 91 1B 40
0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x34b7a:$x1: GetKeyloggerLogsResponse 0x34dba:$s1: DoShellExecuteResponse 0x34733:$s2: GetPasswordsResponse 0x34c8d:$s3: GetStartupItemsResponse 0x340eb:$s5: RunHidden 0x34109:$s5: RunHidden 0x34117:$s5: RunHidden 0x3412b:$s5: RunHidden
0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x3e31d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x3e4ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x407e5:$x2: Process already elevated. 0x324a0:$x4: get_encryptedPassword 0x342e5:$x5: DoDownloadAndExecute
0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
5.2.FacebookSecurityUpdate.exe.600000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
5.2.FacebookSecurityUpdate.exe.600000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
5.2.FacebookSecurityUpdate.exe.600000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
5.2.FacebookSecurityUpdate.exe.600000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
5.2.FacebookSecurityUpdate.exe.600000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
5.2.FacebookSecurityUpdate.exe.600000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
5.2.FacebookSecurityUpdate.exe.600000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
2.2.FacebookSecurityUpdate.exe.d90000.0.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets
2.2.FacebookSecurityUpdate.exe.d90000.0.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x35f13:$s7: set_RunHidden
2.2.FacebookSecurityUpdate.exe.d90000.0.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40
2.2.FacebookSecurityUpdate.exe.d90000.0.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden
2.2.FacebookSecurityUpdate.exe.d90000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
2.2.FacebookSecurityUpdate.exe.d90000.0.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute
2.2.FacebookSecurityUpdate.exe.d90000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack	Vermin_Keylogger_Jan18_1	Detects Vermin Keylogger	Florian Roth	0x3697a:$x3: GetKeyloggerLogsResponse 0x8f7b2:$x3: GetKeyloggerLogsResponse 0x35c51:$x4: GetKeyloggerLogs 0x8ea89:$x4: GetKeyloggerLogs 0x35eea:$s1: <RunHidden>k__BackingField 0x8ed22:$s1: <RunHidden>k__BackingField 0x36b42:$s2: set_SystemInfos 0x8f97a:$s2: set_SystemInfos 0x35f13:$s3: set_RunHidden 0x8ed4b:$s3: set_RunHidden 0x35aa6:$s4: set_RemotePath 0x8e8de:$s4: set_RemotePath 0x30971:$s7: xClient.Core.ReverseProxy.Packets 0x897a9:$s7: xClient.Core.ReverseProxy.Packets
0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack	xRAT_1	Detects Patchwork malware	Florian Roth	0x2f783:$x4: xClient.Properties.Resources.resources 0x885bb:$x4: xClient.Properties.Resources.resources 0x2f621:$s4: Client.exe 0x88459:$s4: Client.exe 0x35f13:$s7: set_RunHidden 0x8ed4b:$s7: set_RunHidden
0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x8ed0f:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x8ef1d:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x8eb13:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x8eee2:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x5fa00:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x5f924:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40 0x6038a:$op3: 00 04 03 69 91 1B 40 0x60bda:$op3: 00 04 03 69 91 1B 40
0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x8f7b2:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x8f9f2:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x8f36b:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x8f8c5:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden 0x8ed23:$s5: RunHidden 0x8ed41:$s5: RunHidden 0x8ed4f:$s5: RunHidden 0x8ed63:$s5: RunHidden
0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x98f55:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ... 0x99125:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack	CN_disclosed_20180208_KeyLogger_1	Detects malware from disclosed CN malware set	Florian Roth	0x425e5:$x2: Process already elevated. 0x9b41d:$x2: Process already elevated. 0x342a0:$x4: get_encryptedPassword 0x8d0d8:$x4: get_encryptedPassword 0x360e5:$x5: DoDownloadAndExecute 0x8ef1d:$x5: DoDownloadAndExecute
0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
0.2.FacebookSecurityUpdate.exe.12dfb378.3.raw.unpack	Quasar_RAT_1	Detects Quasar RAT	Florian Roth	0x35ed7:$s1: DoUploadAndExecute 0x8ed1f:$s1: DoUploadAndExecute 0xe7b57:$s1: DoUploadAndExecute 0x360e5:$s2: DoDownloadAndExecute 0x8ef2d:$s2: DoDownloadAndExecute 0xe7d65:$s2: DoDownloadAndExecute 0x35cdb:$s3: DoShellExecute 0x8eb23:$s3: DoShellExecute 0xe795b:$s3: DoShellExecute 0x360aa:$s4: set_Processname 0x8eef2:$s4: set_Processname 0xe7d2a:$s4: set_Processname 0x6bc8:$op1: 04 1E FE 02 04 16 FE 01 60 0x5fa10:$op1: 04 1E FE 02 04 16 FE 01 60 0xb8848:$op1: 04 1E FE 02 04 16 FE 01 60 0x6aec:$op2: 00 17 03 1F 20 17 19 15 28 0x5f934:$op2: 00 17 03 1F 20 17 19 15 28 0xb876c:$op2: 00 17 03 1F 20 17 19 15 28 0x7552:$op3: 00 04 03 69 91 1B 40 0x7da2:$op3: 00 04 03 69 91 1B 40 0x6039a:$op3: 00 04 03 69 91 1B 40
0.2.FacebookSecurityUpdate.exe.12dfb378.3.raw.unpack	Quasar_RAT_2	Detects Quasar RAT	Florian Roth	0x3697a:$x1: GetKeyloggerLogsResponse 0x8f7c2:$x1: GetKeyloggerLogsResponse 0xe85fa:$x1: GetKeyloggerLogsResponse 0x36bba:$s1: DoShellExecuteResponse 0x8fa02:$s1: DoShellExecuteResponse 0xe883a:$s1: DoShellExecuteResponse 0x36533:$s2: GetPasswordsResponse 0x8f37b:$s2: GetPasswordsResponse 0xe81b3:$s2: GetPasswordsResponse 0x36a8d:$s3: GetStartupItemsResponse 0x8f8d5:$s3: GetStartupItemsResponse 0xe870d:$s3: GetStartupItemsResponse 0x35eeb:$s5: RunHidden 0x35f09:$s5: RunHidden 0x35f17:$s5: RunHidden 0x35f2b:$s5: RunHidden 0x8ed33:$s5: RunHidden 0x8ed51:$s5: RunHidden 0x8ed5f:$s5: RunHidden 0x8ed73:$s5: RunHidden 0xe7b6b:$s5: RunHidden
0.2.FacebookSecurityUpdate.exe.12dfb378.3.raw.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x4011d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x98f65:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0xf1d9d:$xc1: 41 00 64 00 6D 00 69 00 6E 00 00 11 73 00 63 00 68 00 74 00 61 00 73 00 6B 00 73 00 00 1B 2F 00 ... 0x402ed:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ... 0x99135:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ... 0xf1f6d:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C ...
0.2.FacebookSecurityUpdate.exe.12dfb378.3.raw.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Click to see the 76 entries

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: FacebookSecurityUpdate.exe

Avira: detected

Antivirus detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	Avira: detection malicious, Label: HEUR/AGEN.1135947
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	Avira: detection malicious, Label: HEUR/AGEN.1135947

Found malware configuration

Show sources

Source: 00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp

Malware Configuration Extractor: Quasar {"Version": "1.4.0.0", "Host:Port": "84.38.133.101:14782;", "SubDirectory": "FacebookSecurityUpdate", "InstallName": "#za6H\"om,", "MutexName": "EhJ5YrFqRiwpbh4NdP", "StartupKey": "FacebookSecurityUpdate", "Tag": "SecurityHealthServices-WinRar", "LogDirectoryName": "Logs"}

Multi AV Scanner detection for submitted file

Show sources

Source: FacebookSecurityUpdate.exe	Virustotal: Detection: 57%			Perma Link
Source: FacebookSecurityUpdate.exe	ReversingLabs: Detection: 50%

Yara detected Quasar RAT

Show sources

Source: Yara match	File source: 00000002.00000002.202794643.0000000000D92000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.193556825.0000000000D92000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.211316911.0000000000182000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.457267428.0000000000602000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.202485476.0000000000602000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FacebookSecurityUpdate.exe PID: 6124, type: MEMORY
Source: Yara match	File source: Process Memory Space: FacebookSecurityUpdate.exe PID: 5648, type: MEMORY
Source: Yara match	File source: Process Memory Space: FacebookSecurityUpdate.exe PID: 5640, type: MEMORY
Source: Yara match	File source: Process Memory Space: FacebookSecurityUpdate.exe PID: 3348, type: MEMORY
Source: Yara match	File source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe, type: DROPPED
Source: Yara match	File source: 6.0.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.FacebookSecurityUpdate.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.FacebookSecurityUpdate.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.FacebookSecurityUpdate.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.FacebookSecurityUpdate.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.raw.unpack, type: UNPACKEDPE

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	Joe Sandbox ML: detected
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Show sources

Source: FacebookSecurityUpdate.exe

Joe Sandbox ML: detected

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\FacebookSecurityUpdate.exe

Unpacked PE file: 0.2.FacebookSecurityUpdate.exe.b00000.0.unpack

Source: FacebookSecurityUpdate.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: FacebookSecurityUpdate.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Spreading:

Creates autorun.inf (USB autostart)

Show sources

Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe

File created: C:\autorun.inf

Jump to behavior

Source: FacebookSecurityUpdate.exe, 00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp	Binary or memory string: autorun.inf.exe
Source: FacebookSecurityUpdate.exe, 00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp	Binary or memory string: [AutoRun]
Source: FacebookSecurityUpdate.exe	Binary or memory string: [AutoRun]
Source: FacebookSecurityUpdate.exe	Binary or memory string: autorun.inf
Source: FacebookSecurityUpdate.exe, 00000002.00000002.202794643.0000000000D92000.00000002.00020000.sdmp	Binary or memory string: autorun.inf.exe
Source: FacebookSecurityUpdate.exe	Binary or memory string: [AutoRun]
Source: FacebookSecurityUpdate.exe	Binary or memory string: autorun.inf
Source: FacebookSecurityUpdate.exe, 00000005.00000002.459478315.0000000002B7A000.00000004.00000001.sdmp	Binary or memory string: l[AutoRun]
Source: FacebookSecurityUpdate.exe, 00000005.00000002.457267428.0000000000602000.00000002.00020000.sdmp	Binary or memory string: autorun.inf.exe
Source: FacebookSecurityUpdate.exe	Binary or memory string: autorun.inf
Source: FacebookSecurityUpdate.exe	Binary or memory string: [AutoRun]
Source: FacebookSecurityUpdate.exe, 00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp	Binary or memory string: autorun.inf.exe
Source: autorun.inf.5.dr	Binary or memory string: [AutoRun]
Source: FacebookSecurityUpdate.exe.0.dr	Binary or memory string: autorun.inf.exe

Source: C:\Users\user\Desktop\FacebookSecurityUpdate.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\FacebookSecurityUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\FacebookSecurityUpdate.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\FacebookSecurityUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\FacebookSecurityUpdate.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\FacebookSecurityUpdate.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: 84.38.133.101

Connects to many ports of the same IP (likely port scanning)

Show sources

Source: global traffic

TCP traffic: 84.38.133.101 ports 14782,1,2,4,7,8

May check the online IP address of the machine

Show sources

Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe	DNS query: name: ip-api.com
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe	DNS query: name: ip-api.com

Source: global traffic

TCP traffic: 192.168.2.3:49709 -> 84.38.133.101:14782

Source: Joe Sandbox View

IP Address: 208.95.112.1 208.95.112.1

Source: Joe Sandbox View

ASN Name: DATACLUB-NL DATACLUB-NL

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive

Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101
Source: unknown	TCP traffic detected without corresponding DNS query: 84.38.133.101

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:48.0) Gecko/20100101 Firefox/48.0Host: ip-api.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: ip-api.com

Source: FacebookSecurityUpdate.exe, FacebookSecurityUpdate.exe, 00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp, FacebookSecurityUpdate.exe.0.dr	String found in binary or memory: http://api.ipify.org/
Source: FacebookSecurityUpdate.exe, FacebookSecurityUpdate.exe, 00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp, FacebookSecurityUpdate.exe.0.dr	String found in binary or memory: http://freegeoip.net/xml/
Source: FacebookSecurityUpdate.exe, 00000002.00000002.203567334.000000000322E000.00000004.00000001.sdmp, FacebookSecurityUpdate.exe, 00000005.00000002.459447063.0000000002B41000.00000004.00000001.sdmp	String found in binary or memory: http://ip-api.com
Source: FacebookSecurityUpdate.exe, FacebookSecurityUpdate.exe, 00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp, FacebookSecurityUpdate.exe.0.dr	String found in binary or memory: http://ip-api.com/json/
Source: FacebookSecurityUpdate.exe, 00000002.00000002.203567334.000000000322E000.00000004.00000001.sdmp	String found in binary or memory: http://ip-api.com4
Source: FacebookSecurityUpdate.exe, 00000002.00000002.203600363.000000000327D000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.datacontract.org
Source: FacebookSecurityUpdate.exe, 00000002.00000002.203600363.000000000327D000.00000004.00000001.sdmp, FacebookSecurityUpdate.exe, 00000005.00000002.459478315.0000000002B7A000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/
Source: FacebookSecurityUpdate.exe, 00000002.00000002.203600363.000000000327D000.00000004.00000001.sdmp, FacebookSecurityUpdate.exe, 00000005.00000002.459478315.0000000002B7A000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.datacontract.org/2004/07/xClient.Core.Data
Source: FacebookSecurityUpdate.exe, 00000002.00000002.203567334.000000000322E000.00000004.00000001.sdmp, FacebookSecurityUpdate.exe, 00000005.00000002.459447063.0000000002B41000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Installs a global keyboard hook

Show sources

Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe

Windows user hook set: 0 keyboard low level C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe

Jump to behavior

E-Banking Fraud:

Yara detected Quasar RAT

Show sources

Source: Yara match	File source: 00000002.00000002.202794643.0000000000D92000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000000.193556825.0000000000D92000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.211316911.0000000000182000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.457267428.0000000000602000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000000.202485476.0000000000602000.00000002.00020000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: FacebookSecurityUpdate.exe PID: 6124, type: MEMORY
Source: Yara match	File source: Process Memory Space: FacebookSecurityUpdate.exe PID: 5648, type: MEMORY
Source: Yara match	File source: Process Memory Space: FacebookSecurityUpdate.exe PID: 5640, type: MEMORY
Source: Yara match	File source: Process Memory Space: FacebookSecurityUpdate.exe PID: 3348, type: MEMORY
Source: Yara match	File source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe, type: DROPPED
Source: Yara match	File source: 6.0.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12e541c0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.0.FacebookSecurityUpdate.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.0.FacebookSecurityUpdate.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12eacff8.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12eacff8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.FacebookSecurityUpdate.exe.600000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.FacebookSecurityUpdate.exe.d90000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12e541c0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.raw.unpack, type: UNPACKEDPE

Spam, unwanted Advertisements and Ransom Demands:

Deletes shadow drive data (may be related to ransomware)

Show sources

Source: FacebookSecurityUpdate.exe, 00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp	Binary or memory string: cmd.exeU/C vssadmin.exe Delete Shadows /All /Quiet
Source: FacebookSecurityUpdate.exe	Binary or memory string: /C vssadmin.exe Delete Shadows /All /Quiet
Source: FacebookSecurityUpdate.exe, 00000002.00000002.202794643.0000000000D92000.00000002.00020000.sdmp	Binary or memory string: cmd.exeU/C vssadmin.exe Delete Shadows /All /Quiet
Source: FacebookSecurityUpdate.exe	Binary or memory string: /C vssadmin.exe Delete Shadows /All /Quiet
Source: FacebookSecurityUpdate.exe, 00000005.00000002.457267428.0000000000602000.00000002.00020000.sdmp	Binary or memory string: cmd.exeU/C vssadmin.exe Delete Shadows /All /Quiet
Source: FacebookSecurityUpdate.exe	Binary or memory string: /C vssadmin.exe Delete Shadows /All /Quiet
Source: FacebookSecurityUpdate.exe, 00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp	Binary or memory string: cmd.exeU/C vssadmin.exe Delete Shadows /All /Quiet
Source: FacebookSecurityUpdate.exe.0.dr	Binary or memory string: cmd.exeU/C vssadmin.exe Delete Shadows /All /Quiet

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 00000002.00000002.202794643.0000000000D92000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000006.00000000.203445324.0000000000182000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000000.00000002.194570475.0000000012DFB000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000002.00000000.193556825.0000000000D92000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000006.00000002.211316911.0000000000182000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000005.00000002.457267428.0000000000602000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 00000005.00000000.202485476.0000000000602000.00000002.00020000.sdmp, type: MEMORY	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Windows\SysWOW64\FacebookSecurityUpdate\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\FacebookSecurityUpdate.exe, type: DROPPED	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 6.0.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 6.0.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 6.0.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 6.0.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 6.0.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 6.0.FacebookSecurityUpdate.exe.180000.0.unpack, type: UNPACKEDPE	Matched rule: Detects malware from disclosed CN malware set Author: Florian Roth
Source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack, type: UNPACKEDPE	Matched rule: Detects Vermin Keylogger Author: Florian Roth
Source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack, type: UNPACKEDPE	Matched rule: Detects Patchwork malware Author: Florian Roth
Source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar RAT Author: Florian Roth
Source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 0.2.FacebookSecurityUpdate.exe.12dfb378.3.unpack, type: UNPACKEDPE	Matched rule: Detects ma<

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report FacebookSecurityUpdate.exe

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Threatname: Quasar

Yara Overview

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

E-Banking Fraud:

Spam, unwanted Advertisements and Ransom Demands:

System Summary: