popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cred64.dll

Ave Maria WARZONE RAT UPX Malicious Library PE64 DLL OS Processor Check PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us April 10, 2023, 9:33 a.m. April 10, 2023, 9:35 a.m.
Size 1.0MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 4458e8114c5e302f791c868ef0e54cd0
SHA256 d21ad34cae7ed180a96b1c1ca3ee8e8c06a0e8cde698b82a596a9e319c91945f
CRC32 C7BC87DB
ssdeep 24576:XMq/RX0hoa8wrC+azFbtZhUYFauTZyRMRo:Xioa8wrCHz3ZhUYRAao
PDB Path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
Save+0x8d733 Main-0x1478d cred64+0x91b73 @ 0x7fef3db1b73
Save+0x8f34b Main-0x12b75 cred64+0x9378b @ 0x7fef3db378b
Save+0x903d3 Main-0x11aed cred64+0x94813 @ 0x7fef3db4813
Save+0x9077f Main-0x11741 cred64+0x94bbf @ 0x7fef3db4bbf
Save+0xa18a8 Main-0x618 cred64+0xa5ce8 @ 0x7fef3dc5ce8
Main+0x65 cred64+0xa6365 @ 0x7fef3dc6365
rundll32+0x2f42 @ 0xff852f42
rundll32+0x3b7a @ 0xff853b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa
exception.instruction: cmp byte ptr [rax + r8], dil
exception.exception_code: 0xc0000005
exception.symbol: Save+0x8d733 Main-0x1478d cred64+0x91b73
exception.address: 0x7fef3db1b73
registers.r14: 0
registers.r15: 0
registers.rcx: 1099511627775
registers.rsi: 0
registers.r10: 273
registers.rbx: 0
registers.rsp: 2162096
registers.r11: 2156992
registers.r8: 0
registers.r9: 236236177417
registers.rdx: 2600992
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1
registers.r13: 0
1 0 0
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Mikey.143765
FireEye Gen:Variant.Mikey.143765
CAT-QuickHeal Trojan.Multi
ALYac Gen:Variant.Mikey.143765
Malwarebytes Spyware.PasswordStealer
VIPRE Gen:Variant.Mikey.143765
Sangfor Infostealer.Win64.Amadey.Vnbm
CrowdStrike win/malicious_confidence_100% (W)
Alibaba TrojanPSW:Win64/Stealer.5ef1676c
K7GW Riskware ( 00584baa1 )
K7AntiVirus Riskware ( 00584baa1 )
Arcabit Trojan.Mikey.D23195
VirIT Trojan.Win64.Genus.LR
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.G
Cynet Malicious (score: 100)
Paloalto generic.ml
ClamAV Win.Malware.Zusy-9985435-0
Kaspersky Trojan-PSW.Win64.Stealer.agq
BitDefender Gen:Variant.Mikey.143765
Avast Win64:TrojanX-gen [Trj]
Tencent Win64.Trojan-QQPass.QQRob.Simw
Emsisoft Gen:Variant.Mikey.143765 (B)
F-Secure Trojan.TR/Redcap.setbo
DrWeb Trojan.SpyBot.1205
Zillya Trojan.Stealer.Win64.120
TrendMicro TROJ_GEN.R002C0DD823
McAfee-GW-Edition BehavesLike.Win64.Dropper.th
Sophos Troj/Steal-DCI
Jiangmin Trojan.PSW.Stealer.cfw
Webroot W32.Trojan.Gen
Avira TR/Redcap.setbo
MAX malware (ai score=82)
Antiy-AVL Trojan[PSW]/Win32.Convagent
Microsoft Trojan:Win64/Amadey.CAV!MTB
ViRobot Trojan.Win.Z.Mikey.1088512.J
ZoneAlarm Trojan-PSW.Win64.Stealer.agq
GData Gen:Variant.Mikey.143765
Google Detected
AhnLab-V3 Trojan/Win.Generic.R561816
McAfee PWS-FDPG!4458E8114C5E
TACHYON Trojan-PWS/W64.InfoStealer.1088512
Cylance unsafe
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.R002C0DD823
Rising Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)
Yandex Trojan.DL.Amadey!1QLNIVmbpAQ
Ikarus Trojan-PSW.Agent