popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cred64.dll

Browser Login Data Stealer UPX Malicious Library PE64 PE File DLL OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us July 28, 2023, 5:22 p.m. July 28, 2023, 5:28 p.m.
Size 1.0MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 ad29bf6fe83170168693e9a8b2707b58
SHA256 1b04e2c362f4dade4d65282651df7323111cce5f6327f7f11eb4a5d782eb43ac
CRC32 0C278638
ssdeep 24576:DMq/RX0hoa8wrC+azFbtZhUYFauTZyRMpl:Dioa8wrCHz3ZhUYRAKl
PDB Path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara
  • UPX_Zero - UPX packed file
  • OS_Processor_Check_Zero - OS Processor Check
  • IsDLL - (no description)
  • infoStealer_browser_b_Zero - browser info stealer
  • IsPE64 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
Save+0x8d733 Main-0x1478d cred64+0x91b73 @ 0x7fef3da1b73
Save+0x8f34b Main-0x12b75 cred64+0x9378b @ 0x7fef3da378b
Save+0x903d3 Main-0x11aed cred64+0x94813 @ 0x7fef3da4813
Save+0x9077f Main-0x11741 cred64+0x94bbf @ 0x7fef3da4bbf
Save+0xa18a8 Main-0x618 cred64+0xa5ce8 @ 0x7fef3db5ce8
Main+0x65 cred64+0xa6365 @ 0x7fef3db6365
rundll32+0x2f42 @ 0xff582f42
rundll32+0x3b7a @ 0xff583b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521

exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa
exception.instruction: cmp byte ptr [rax + r8], dil
exception.exception_code: 0xc0000005
exception.symbol: Save+0x8d733 Main-0x1478d cred64+0x91b73
exception.address: 0x7fef3da1b73
registers.r14: 0
registers.r15: 0
registers.rcx: 1099511627775
registers.rsi: 0
registers.r10: 273
registers.rbx: 0
registers.rsp: 2029600
registers.r11: 2024496
registers.r8: 0
registers.r9: 236236177417
registers.rdx: 3715104
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1
registers.r13: 0
1 0 0
Bkav W32.LicheeWantyG.Trojan
Lionic Trojan.Win32.Stealer.12!c
Cynet Malicious (score: 100)
CAT-QuickHeal TrojanPWS.Amadey.S30177655
ALYac Gen:Variant.Mikey.143765
Malwarebytes Amadey.Trojan.Downloader.DDS
Zillya Trojan.Stealer.Win64.118
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan-Downloader ( 005a0ec91 )
Alibaba TrojanPSW:Win64/Stealer.ad0b44f1
K7GW Trojan-Downloader ( 005a0ec91 )
CrowdStrike win/malicious_confidence_100% (W)
VirIT Trojan.Win64.Genus.LR
Cyren W64/Upatre.QH.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.G
ClamAV Win.Malware.Zusy-9985435-0
Kaspersky Trojan-PSW.Win64.Stealer.amp
BitDefender Gen:Variant.Mikey.143765
NANO-Antivirus Trojan.Win64.SpyBot.jvxsbg
ViRobot Trojan.Win.Z.Mikey.1088512.L
MicroWorld-eScan Gen:Variant.Mikey.143765
Avast Win64:PWSX-gen [Trj]
Rising Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)
TACHYON Trojan-PWS/W64.InfoStealer.1088512
Emsisoft Gen:Variant.Mikey.143765 (B)
F-Secure Trojan.TR/Redcap.ybubo
DrWeb Trojan.SpyBot.1205
VIPRE Gen:Variant.Mikey.143765
TrendMicro TROJ_GEN.R03BC0DDN23
McAfee-GW-Edition BehavesLike.Win64.Emotet.th
FireEye Gen:Variant.Mikey.143765
Sophos Troj/Steal-DCI
GData Gen:Variant.Mikey.143765
Jiangmin Trojan.PSW.Stealer.cfw
Avira TR/Redcap.ybubo
Antiy-AVL Trojan[PSW]/Win32.Convagent
Arcabit Trojan.Mikey.D23195
ZoneAlarm Trojan-PSW.Win64.Stealer.amp
Microsoft Trojan:Win64/Amadey.CAV!MTB
Google Detected
AhnLab-V3 Trojan/Win.Generic.R561816
McAfee PWS-FDPG!AD29BF6FE831
MAX malware (ai score=89)
VBA32 TrojanPSW.Win64.Stealer
Cylance unsafe
Panda Trj/CI.A
TrendMicro-HouseCall TROJ_GEN.R03BC0DDN23
Tencent Malware.Win32.Gencirc.10beb1b5