popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cred64.dll

Ave Maria WARZONE RAT UPX Malicious Library PE64 DLL OS Processor Check PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us June 14, 2023, 7:57 p.m. June 14, 2023, 8 p.m.
Size 1.0MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 e6ab640c5271a1c4dda09a46e63aeb81
SHA256 6d9865345877c9d57b7589392d8870ab7a225287606b9e2019860737cd5da4fe
CRC32 FC6EA5A7
ssdeep 24576:KMq/RX0hoa8wrC+azFbtZhUYFauTZyRMws:Kioa8wrCHz3ZhUYRA/s
PDB Path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
Save+0x8d733 Main-0x1478d cred64+0x91b73 @ 0x7fef3da1b73
Save+0x8f34b Main-0x12b75 cred64+0x9378b @ 0x7fef3da378b
Save+0x903d3 Main-0x11aed cred64+0x94813 @ 0x7fef3da4813
Save+0x9077f Main-0x11741 cred64+0x94bbf @ 0x7fef3da4bbf
Save+0xa18a8 Main-0x618 cred64+0xa5ce8 @ 0x7fef3db5ce8
Main+0x65 cred64+0xa6365 @ 0x7fef3db6365
rundll32+0x2f42 @ 0xffa72f42
rundll32+0x3b7a @ 0xffa73b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa
exception.instruction: cmp byte ptr [rax + r8], dil
exception.exception_code: 0xc0000005
exception.symbol: Save+0x8d733 Main-0x1478d cred64+0x91b73
exception.address: 0x7fef3da1b73
registers.r14: 0
registers.r15: 0
registers.rcx: 1099511627775
registers.rsi: 0
registers.r10: 273
registers.rbx: 0
registers.rsp: 1309248
registers.r11: 1304144
registers.r8: 0
registers.r9: 236236177417
registers.rdx: 3452960
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1
registers.r13: 0
1 0 0
Lionic Trojan.Win32.Stealer.12!c
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Mikey.143765
FireEye Gen:Variant.Mikey.143765
ALYac Gen:Variant.Mikey.143765
Malwarebytes Amadey.Trojan.Downloader.DDS
Zillya Trojan.Stealer.Win64.120
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 005a0ec91 )
Alibaba TrojanPSW:Win64/Stealer.bf2fdc21
K7GW Trojan-Downloader ( 005a0ec91 )
CrowdStrike win/malicious_confidence_100% (W)
VirIT Trojan.Win64.Genus.LR
Cyren W64/Upatre.QH.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.G
Cynet Malicious (score: 100)
ClamAV Win.Malware.Zusy-9985435-0
Kaspersky Trojan-PSW.Win64.Stealer.axp
BitDefender Gen:Variant.Mikey.143765
Avast Win64:TrojanX-gen [Trj]
Tencent Malware.Win32.Gencirc.11923455
TACHYON Trojan-PWS/W64.InfoStealer.1088512
Sophos Troj/Steal-DCI
F-Secure Trojan.TR/Redcap.zhhbt
DrWeb Trojan.SpyBot.1205
VIPRE Gen:Variant.Mikey.143765
TrendMicro TROJ_GEN.R03BC0DF623
McAfee-GW-Edition BehavesLike.Win64.Dropper.th
Emsisoft Gen:Variant.Mikey.143765 (B)
Jiangmin Trojan.PSW.Stealer.cfw
Avira TR/Redcap.zhhbt
Antiy-AVL Trojan[PSW]/Win32.Convagent
Microsoft Trojan:Win64/Amadey.CAV!MTB
Arcabit Trojan.Mikey.D23195
ViRobot Trojan.Win.Z.Mikey.1088512.U
ZoneAlarm Trojan-PSW.Win64.Stealer.axp
GData Gen:Variant.Mikey.143765
Google Detected
AhnLab-V3 Trojan/Win.Generic.R561816
McAfee PWS-FDPG!E6AB640C5271
MAX malware (ai score=88)
Cylance unsafe
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R03BC0DF623
Rising Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)
Yandex Trojan.DL.Amadey!1QLNIVmbpAQ
Ikarus Trojan-PSW.Agent
Fortinet W32/Amadey.G!tr.dldr
AVG Win64:TrojanX-gen [Trj]