popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cred64.dll

Browser Login Data Stealer UPX Malicious Library PE64 PE File DLL OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 June 19, 2023, 6:08 p.m. June 19, 2023, 6:08 p.m.
Size 1.0MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 7b4ebf09cf37a88ab510a9fc4657f15e
SHA256 1819b02e5de2331b27a7d8d58acb27d26fa35b85fc9ce6fcbb742705f712d3a2
CRC32 7BBB2DBA
ssdeep 24576:iMq/RX0hoa8wrC+azFbtZhUYFauTZyRMX3:iioa8wrCHz3ZhUYRAE3
PDB Path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • infoStealer_browser_b_Zero - browser info stealer
  • Malicious_Library_Zero - Malicious_Library
  • IsPE64 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
section _RDATA
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2816
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
Lionic Trojan.Win32.Convagent.4!c
MicroWorld-eScan Gen:Variant.Mikey.143765
ClamAV Win.Malware.Zusy-9985435-0
McAfee PWS-FDPG!7B4EBF09CF37
Cylance unsafe
Zillya Trojan.Stealer.Win64.119
Sangfor Infostealer.Win64.Agent.Vbnt
CrowdStrike win/malicious_confidence_100% (W)
BitDefender Gen:Variant.Mikey.143765
K7GW Password-Stealer ( 0059c99d1 )
K7AntiVirus Password-Stealer ( 0059c99d1 )
VirIT Trojan.Win64.Genus.LR
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.G
Paloalto generic.ml
Cynet Malicious (score: 100)
Kaspersky Trojan-PSW.Win64.Stealer.xr
Alibaba TrojanPSW:Win64/Stealer.402624a3
NANO-Antivirus Trojan.Win64.SpyBot.jvhgjd
Avast Win64:TrojanX-gen [Trj]
Tencent Malware.Win32.Gencirc.1185b932
TACHYON Trojan-PWS/W64.InfoStealer.1088512
Emsisoft Gen:Variant.Mikey.143765 (B)
F-Secure Trojan.TR/PSW.Agent.fvghl
DrWeb Trojan.SpyBot.1205
VIPRE Gen:Variant.Mikey.143765
TrendMicro TROJ_GEN.R002C0DCB23
McAfee-GW-Edition BehavesLike.Win64.Dropper.th
FireEye Gen:Variant.Mikey.143765
Sophos Troj/Steal-DCI
GData Gen:Variant.Mikey.143765
Jiangmin Trojan.PSW.Stealer.cfw
Webroot W32.Trojan.Gen
Avira TR/PSW.Agent.fvghl
Antiy-AVL Trojan[PSW]/Win32.Stealer
Gridinsoft Ransom.Win64.Sabsik.cl
Xcitium Malware@#jrz0h5ut3hqk
Arcabit Trojan.Mikey.D23195
ZoneAlarm Trojan-PSW.Win64.Stealer.xr
Microsoft Trojan:Win64/Redline!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.R561816
VBA32 TrojanPSW.Convagent
ALYac Gen:Variant.Mikey.143765
MAX malware (ai score=89)
Malwarebytes Spyware.PasswordStealer
Panda Trj/Chgt.AD
TrendMicro-HouseCall TROJ_GEN.R002C0DCB23
Rising Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)