popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cred64.dll

Ave Maria WARZONE RAT UPX Malicious Library PE64 DLL OS Processor Check PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us March 9, 2023, 9:55 a.m. March 9, 2023, 10:01 a.m.
Size 1.0MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 7b4ebf09cf37a88ab510a9fc4657f15e
SHA256 1819b02e5de2331b27a7d8d58acb27d26fa35b85fc9ce6fcbb742705f712d3a2
CRC32 7BBB2DBA
ssdeep 24576:iMq/RX0hoa8wrC+azFbtZhUYFauTZyRMX3:iioa8wrCHz3ZhUYRAE3
PDB Path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT
  • PE_Header_Zero - PE File Signature
  • IsPE64 - (no description)

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
Save+0x8d733 Main-0x1478d cred64+0x91b73 @ 0x7fef3db1b73
Save+0x8f34b Main-0x12b75 cred64+0x9378b @ 0x7fef3db378b
Save+0x903d3 Main-0x11aed cred64+0x94813 @ 0x7fef3db4813
Save+0x9077f Main-0x11741 cred64+0x94bbf @ 0x7fef3db4bbf
Save+0xa18a8 Main-0x618 cred64+0xa5ce8 @ 0x7fef3dc5ce8
Main+0x65 cred64+0xa6365 @ 0x7fef3dc6365
rundll32+0x2f42 @ 0xff1a2f42
rundll32+0x3b7a @ 0xff1a3b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa
exception.instruction: cmp byte ptr [rax + r8], dil
exception.exception_code: 0xc0000005
exception.symbol: Save+0x8d733 Main-0x1478d cred64+0x91b73
exception.address: 0x7fef3db1b73
registers.r14: 0
registers.r15: 0
registers.rcx: 1099511627775
registers.rsi: 0
registers.r10: 273
registers.rbx: 0
registers.rsp: 1834640
registers.r11: 1829536
registers.r8: 0
registers.r9: 236236177417
registers.rdx: 2142240
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1
registers.r13: 0
1 0 0
Lionic Trojan.Win32.Convagent.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Mikey.143765
FireEye Gen:Variant.Mikey.143765
CAT-QuickHeal Trojanpws.Convagent
McAfee Artemis!7B4EBF09CF37
Sangfor Infostealer.Win32.Agent.Vdyf
K7AntiVirus Password-Stealer ( 0059c99d1 )
Alibaba TrojanPSW:Win64/Stealer.308a8ddc
K7GW Password-Stealer ( 0059c99d1 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Mikey.D23195
VirIT Trojan.Win64.Genus.LR
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.G
Cynet Malicious (score: 100)
Paloalto generic.ml
ClamAV Win.Malware.Zusy-9985435-0
Kaspersky Trojan-PSW.Win64.Stealer.xr
BitDefender Gen:Variant.Mikey.143765
Avast Win64:TrojanX-gen [Trj]
Tencent Malware.Win32.Gencirc.1185b932
Sophos Troj/Steal-DCI
F-Secure Trojan.TR/PSW.Agent.fvghl
VIPRE Gen:Variant.Mikey.143765
McAfee-GW-Edition BehavesLike.Win64.Dropper.th
Emsisoft Gen:Variant.Mikey.143765 (B)
Avira TR/PSW.Agent.fvghl
Antiy-AVL Trojan[PSW]/Win32.Stealer
Gridinsoft Ransom.Win64.Sabsik.cl
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ViRobot Trojan.Win.Z.Mikey.1088512.D
ZoneAlarm Trojan-PSW.Win64.Stealer.xr
GData Gen:Variant.Mikey.143765
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5288456
VBA32 TrojanPSW.Convagent
ALYac Gen:Variant.Mikey.143765
MAX malware (ai score=89)
Malwarebytes Spyware.PasswordStealer
TrendMicro-HouseCall TROJ_GEN.R002H0CC423
Rising Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)
Ikarus Trojan-PSW.Agent
MaxSecure Trojan.Malware.300983.susgen
Fortinet W64/Agent.CW!tr.pws
AVG Win64:TrojanX-gen [Trj]
Panda Trj/Chgt.AD