Summary | ZeroBOX

cred64.dll

Browser Login Data Stealer UPX Malicious Library PE64 PE File DLL OS Processor Check
Category Machine Started Completed
FILE s1_win7_x6401 July 12, 2023, 5:23 p.m. July 12, 2023, 5:25 p.m.
Size 1.1MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 60cf7bdab887c8e4d3425d94ececd8d0
SHA256 414cfc196f16fa63ef7d04492d3bc0d061a886c8f5eb78d62ffa7ac238d5b274
CRC32 19707AA3
ssdeep 24576:7aSSLyrE87ZcT+RZCP6Z1U64yolNVTYqMu3:FE87ZcTsZbZ1UcW2qMu3
PDB Path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • infoStealer_browser_b_Zero - browser info stealer
  • IsPE64 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

0 0

IsDebuggerPresent

0 0
pdb_path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

stacktrace:
Save+0x8d973 Main-0x1478d cred64+0x91e43 @ 0x7fef41e1e43
Save+0x8f58b Main-0x12b75 cred64+0x93a5b @ 0x7fef41e3a5b
Save+0x90613 Main-0x11aed cred64+0x94ae3 @ 0x7fef41e4ae3
Save+0x909bf Main-0x11741 cred64+0x94e8f @ 0x7fef41e4e8f
Save+0xa1ae8 Main-0x618 cred64+0xa5fb8 @ 0x7fef41f5fb8
Main+0x65 cred64+0xa6635 @ 0x7fef41f6635
rundll32+0x2f42 @ 0xff992f42
rundll32+0x3b7a @ 0xff993b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa
exception.instruction: cmp byte ptr [rax + r8], dil
exception.exception_code: 0xc0000005
exception.symbol: Save+0x8d973 Main-0x1478d cred64+0x91e43
exception.address: 0x7fef41e1e43
registers.r14: 0
registers.r15: 0
registers.rcx: 1099511627775
registers.rsi: 0
registers.r10: 24
registers.rbx: 0
registers.rsp: 1833936
registers.r11: 1828832
registers.r8: 0
registers.r9: 249121079305
registers.rdx: 2535184
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

process_identifier: 2816
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

process_identifier: 2808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
MicroWorld-eScan Gen:Variant.Cerbu.160783
FireEye Gen:Variant.Cerbu.160783
ALYac Gen:Variant.Cerbu.160783
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 005a0ec91 )
K7GW Trojan-Downloader ( 005a0ec91 )
CrowdStrike win/malicious_confidence_70% (D)
Arcabit Trojan.Cerbu.D2740F
Cyren W64/ABRisk.XJKB-6059
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.G
Cynet Malicious (score: 100)
ClamAV Win.Malware.Zusy-9985435-0
Kaspersky UDS:Trojan-PSW.Win64.Stealer.bps
BitDefender Gen:Variant.Cerbu.160783
Avast Win64:PWSX-gen [Trj]
Emsisoft Gen:Variant.Cerbu.160783 (B)
F-Secure Heuristic.HEUR/AGEN.1301090
VIPRE Gen:Variant.Cerbu.160783
TrendMicro TROJ_GEN.R014C0DGB23
McAfee-GW-Edition BehavesLike.Win64.Dropper.th
Sophos Troj/Steal-DCI
Webroot W32.Trojan.Gen
Avira HEUR/AGEN.1301090
Microsoft Trojan:Win32/Amadey!ic
ZoneAlarm UDS:Trojan-PSW.Win64.Stealer.bps
GData Gen:Variant.Cerbu.160783
Google Detected
AhnLab-V3 Trojan/Win.Generic.C5288456
McAfee Artemis!60CF7BDAB887
MAX malware (ai score=82)
Malwarebytes Amadey.Trojan.Downloader.DDS
TrendMicro-HouseCall TROJ_GEN.R014C0DGB23
Rising Stealer.Convagent!8.1326D (TFE:5:7c4j9hQ2SPS)
Ikarus Trojan-PSW.Agent
MaxSecure Trojan.Malware.300983.susgen
Fortinet W32/Amadey.G!tr.dldr
AVG Win64:PWSX-gen [Trj]
DeepInstinct MALICIOUS