Overview

overview

10

Static

static

10

Nexware - ...on.exe

windows10-2004-x64

10

Nexware - ...on.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Nexware - Fortnite Free Edition.exe
  • Size 2.0MB
  • Sample260807-3cshvsdp2v
  • SHA256 f01c070825679c0426310584d88ee8e86ac7d9ea3ef4678d47a356994f1aa70b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
quasarfake cs2executionpersistencespywaretrojan

Malware Config

Extracted

Family

  • quasar

Version

  • 1.6.6

Botnet

  • fake cs2

C2

  • localhost:4782

Mutex

  • 45b8b986-4374-4c81-a262-fe0a0ac94115

Attributes
  • encryption_key

    21E9DAB67B97B810D7BA46F047F7595AB92AEDA0

  • install_name

    Nexware CS2 Free Edition.exe

  • key_salt

    5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    NVIDIA Performance Manager

Targets

    • Target
      Nexware - Fortnite Free Edition.exe
    • Size 2.0MB
    • SHA256 f01c070825679c0426310584d88ee8e86ac7d9ea3ef4678d47a356994f1aa70b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    fake cs2executionquasarpersistencespywaretrojan

    • Family: Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks