popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cred64.dll

Ave Maria WARZONE RAT Malicious Library UPX PE64 DLL OS Processor Check PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 19, 2023, 12:38 p.m. Jan. 19, 2023, 12:51 p.m.
Size 1.0MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 6554ed243a87f709ed65ef09bab598b2
SHA256 663c3fca0878472db0ecd4ec4fdc67690c1de08fa5c228e1911b6278cf83a0a6
CRC32 8DA72C3D
ssdeep 24576:OVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43v7G5m:EAhQnZzrZSxxZfVlUT
PDB Path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
Save+0x8d733 Main-0x1371d cred64+0x91303 @ 0x7fef4201303
Save+0x8f34b Main-0x11b05 cred64+0x92f1b @ 0x7fef4202f1b
Save+0x903d3 Main-0x10a7d cred64+0x93fa3 @ 0x7fef4203fa3
Save+0x9077f Main-0x106d1 cred64+0x9434f @ 0x7fef420434f
Save+0xa0838 Main-0x618 cred64+0xa4408 @ 0x7fef4214408
Main+0x65 cred64+0xa4a85 @ 0x7fef4214a85
rundll32+0x2f42 @ 0xffe12f42
rundll32+0x3b7a @ 0xffe13b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 7a
exception.instruction: cmp byte ptr [rax + r8], dil
exception.exception_code: 0xc0000005
exception.symbol: Save+0x8d733 Main-0x1371d cred64+0x91303
exception.address: 0x7fef4201303
registers.r14: 0
registers.r15: 0
registers.rcx: 1099511627775
registers.rsi: 0
registers.r10: 182
registers.rbx: 0
registers.rsp: 2227056
registers.r11: 2221952
registers.r8: 0
registers.r9: 253416505352
registers.rdx: 2928512
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2788
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2828
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
Lionic Trojan.Win32.Stealer.12!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Mikey.143765
FireEye Gen:Variant.Mikey.143765
McAfee Artemis!6554ED243A87
Cylance Unsafe
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanPSW:Win64/Amadey.25b7cd47
K7GW Password-Stealer ( 0059c99d1 )
K7AntiVirus Password-Stealer ( 0059c99d1 )
Arcabit Trojan.Mikey.D23195
VirIT Trojan.Win64.Agent.BUQ
Cyren W64/Kryptik.ISH.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 Win64/PSW.Agent.CW
Cynet Malicious (score: 100)
Kaspersky Trojan-PSW.Win32.Stealer.azfo
BitDefender Gen:Variant.Mikey.143765
NANO-Antivirus Trojan.Win64.Stealer.juihxq
Avast Win64:TrojanX-gen [Trj]
Tencent Win32.Trojan-QQPass.QQRob.Sgil
Emsisoft Gen:Variant.Mikey.143765 (B)
DrWeb Trojan.SpyBot.1180
VIPRE Gen:Variant.Mikey.143765
TrendMicro TROJ_GEN.R002C0DAH23
McAfee-GW-Edition BehavesLike.Win64.Dropper.th
Sophos Mal/Generic-S + Troj/Steal-DCI
Ikarus Trojan-PSW.Agent
Jiangmin Trojan.PSW.Stealer.bxo
Avira TR/AD.Amadey.ykcxs
Antiy-AVL Trojan[PSW]/Win32.Stealer
Gridinsoft Trojan.Win64.Agent.cl
Microsoft Trojan:Win64/Amadey.CA!MTB
GData Gen:Variant.Mikey.143765
Google Detected
AhnLab-V3 Trojan/Win.Generic.R551446
ALYac Gen:Variant.Mikey.143765
MAX malware (ai score=89)
Malwarebytes Spyware.PasswordStealer
TrendMicro-HouseCall TROJ_GEN.R002C0DAH23
Rising Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)
MaxSecure Trojan.Malware.300983.susgen
Fortinet W64/Agent.CW!tr.pws
AVG Win64:TrojanX-gen [Trj]
Panda Trj/CI.A