Malicious
Malicious

Share on LinkedIn
Print
PE Executable
MD5:
Size: 0 B
application/x-dosexec
Ctrl + scroll to zoom · drag to pan

Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.

AI analysis is available with Essential.
Unlock with Essential
File
Type
Portable Executable file
Detection
PeID
.NET executableMicrosoft Visual C# / Basic .NETMicrosoft Visual C# / Basic.NET / MS Visual Basic 2005 - ASL Microsoft Visual C# v7.0 / Basic .NETMicrosoft Visual Studio .NET
Symbol obfuscation
Very high
1 malicious · 10 files
EXEb49d4a49be8a8f960c856d6878914e18XWorm
Structure
Config. Field Value
Mutex Yi9hIhuhuhuhuhuhuhu
Hosts m9dbmhhuhuhuhuhuhuhu
Port 4huhuhuhu
KEY anhuhuhuhu
USBNM <Xwhuhuhuhu
family xhuhuhuhu
We extracted this malware's full configuration (C2, credentials, campaign IDs…).
Unlock with Essential
Name Value
Module Name
rackaz.exe
Full Name
rackaz.exe
EntryPoint
System.Void Stub.dIqASOa7B8XUD::17W1jvKLyeJn9()
Scope Name
rackaz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
rackaz
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
237
Main Method
System.Void Stub.dIqASOa7B8XUD::17W1jvKLyeJn9()
Main IL Instruction Count
58
Main IL 
ldsfld System.Int32 hAftPtovBvGp0::lrduFjZsyxKPA
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String hAftPtovBvGp0::1b7RItvr3TLGd
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::1b7RItvr3TLGd
ldsfld System.String hAftPtovBvGp0::u1e1psQX04kD7
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::u1e1psQX04kD7
ldsfld System.String hAftPtovBvGp0::zSPUC3xhInOtJ
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::zSPUC3xhInOtJ
ldsfld System.String hAftPtovBvGp0::Vp3ew3JLQypYO
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::Vp3ew3JLQypYO
ldsfld System.String hAftPtovBvGp0::pkhubeOq2K6VM
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::pkhubeOq2K6VM
ldsfld System.String hAftPtovBvGp0::48Lxokb9LYKTn
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::48Lxokb9LYKTn
leave.s IL_009E: call System.Boolean Stub.q0H3JNi1HfghK::puxiN5lwJ0Sy7()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.q0H3JNi1HfghK::puxiN5lwJ0Sy7()
call System.Boolean Stub.q0H3JNi1HfghK::puxiN5lwJ0Sy7()
brtrue.s IL_00AB: call System.Void Stub.q0H3JNi1HfghK::mcKZV9GyoEiFf()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.q0H3JNi1HfghK::mcKZV9GyoEiFf()
ldnull <null>
ldftn System.Void Stub.dIqASOa7B8XUD::RjTbswyL4xwWs()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.dIqASOa7B8XUD::pfhEeKbeDRmw5()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Module Name
rackaz.exe
Full Name
rackaz.exe
EntryPoint
System.Void Stub.dIqASOa7B8XUD::17W1jvKLyeJn9()
Scope Name
rackaz.exe
Scope Type
ModuleDef
Kind
Windows
Runtime Version
v4.0.30319
Tables Header Version
512
WinMD Version
<null>
Assembly Name
rackaz
Assembly Version
1.0.0.0
Assembly Culture
<null>
Has PublicKey
False
PublicKey Token
<null>
Target Framework
<null>
Total Strings
237
Main Method
System.Void Stub.dIqASOa7B8XUD::17W1jvKLyeJn9()
Main IL Instruction Count
58
Main IL 
ldsfld System.Int32 hAftPtovBvGp0::lrduFjZsyxKPA
ldc.i4 1000
mul.ovf <null>
call System.Void System.Threading.Thread::Sleep(System.Int32)
ldsfld System.String hAftPtovBvGp0::1b7RItvr3TLGd
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::1b7RItvr3TLGd
ldsfld System.String hAftPtovBvGp0::u1e1psQX04kD7
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::u1e1psQX04kD7
ldsfld System.String hAftPtovBvGp0::zSPUC3xhInOtJ
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::zSPUC3xhInOtJ
ldsfld System.String hAftPtovBvGp0::Vp3ew3JLQypYO
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::Vp3ew3JLQypYO
ldsfld System.String hAftPtovBvGp0::pkhubeOq2K6VM
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::pkhubeOq2K6VM
ldsfld System.String hAftPtovBvGp0::48Lxokb9LYKTn
call System.Object Stub.PEsfIBP9leWvY::CrjPlbUjJVJ7X(System.String)
call System.String Microsoft.VisualBasic.CompilerServices.Conversions::ToString(System.Object)
stsfld System.String hAftPtovBvGp0::48Lxokb9LYKTn
leave.s IL_009E: call System.Boolean Stub.q0H3JNi1HfghK::puxiN5lwJ0Sy7()
dup <null>
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::SetProjectError(System.Exception)
stloc.2 <null>
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Microsoft.VisualBasic.CompilerServices.ProjectData::ClearProjectError()
leave.s IL_009E: call System.Boolean Stub.q0H3JNi1HfghK::puxiN5lwJ0Sy7()
call System.Boolean Stub.q0H3JNi1HfghK::puxiN5lwJ0Sy7()
brtrue.s IL_00AB: call System.Void Stub.q0H3JNi1HfghK::mcKZV9GyoEiFf()
ldc.i4.0 <null>
call System.Void System.Environment::Exit(System.Int32)
call System.Void Stub.q0H3JNi1HfghK::mcKZV9GyoEiFf()
ldnull <null>
ldftn System.Void Stub.dIqASOa7B8XUD::RjTbswyL4xwWs()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.0 <null>
ldnull <null>
ldftn System.Void Stub.dIqASOa7B8XUD::pfhEeKbeDRmw5()
newobj System.Void System.Threading.ThreadStart::.ctor(System.Object,System.IntPtr)
newobj System.Void System.Threading.Thread::.ctor(System.Threading.ThreadStart)
stloc.1 <null>
ldloc.0 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Start()
ldloc.1 <null>
callvirt System.Void System.Threading.Thread::Join()
ret <null>
Mutex MUTEXmalicious
Yi9hIhuhuhuhuhuhuhu
CnC CNCmalicious
m9dbmhhuhuhuhuhuhuhu
Port PORTmalicious
4huhuhuhu
Full artefact values (URLs, paths, registry keys, scripts…) are available with Essential.
Unlock with Essential
An error has occurred. This application may no longer respond until reloaded. Reload 🗙