popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cred64.dll

Browser Login Data Stealer Malicious Library UPX PE64 PE File DLL OS Processor Check
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 4, 2023, 10:17 a.m. Oct. 4, 2023, 10:21 a.m.
Size 1.1MB
Type PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5 74d702c79b9813d2b0379c1d69c60414
SHA256 81e2e8d324728eb23305d68824eb18eac642a858423bbc9fc0f894ba1fd74d69
CRC32 CBBBCDFC
ssdeep 24576:iaS3LyrV872cT+RZCPrZ13b1yolNVQd2haH:1V872cTsZKZ13EW+2haH
PDB Path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • infoStealer_browser_b_Zero - browser info stealer
  • PE_Header_Zero - PE File Signature
  • IsDLL - (no description)
  • IsPE64 - (no description)
  • OS_Processor_Check_Zero - OS Processor Check

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameA

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
pdb_path D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
file C:\Program Files\Mozilla Firefox\firefox.exe
registry HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe
section _RDATA
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
Save+0x8d973 Main-0x1478d cred64+0x91e43 @ 0x7fef41e1e43
Save+0x8f58b Main-0x12b75 cred64+0x93a5b @ 0x7fef41e3a5b
Save+0x90613 Main-0x11aed cred64+0x94ae3 @ 0x7fef41e4ae3
Save+0x909bf Main-0x11741 cred64+0x94e8f @ 0x7fef41e4e8f
Save+0xa1ae8 Main-0x618 cred64+0xa5fb8 @ 0x7fef41f5fb8
Main+0x65 cred64+0xa6635 @ 0x7fef41f6635
rundll32+0x2f42 @ 0xff342f42
rundll32+0x3b7a @ 0xff343b7a
BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d
RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521

exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa
exception.instruction: cmp byte ptr [rax + r8], dil
exception.exception_code: 0xc0000005
exception.symbol: Save+0x8d973 Main-0x1478d cred64+0x91e43
exception.address: 0x7fef41e1e43
registers.r14: 0
registers.r15: 0
registers.rcx: 1099511627775
registers.rsi: 0
registers.r10: 10
registers.rbx: 0
registers.rsp: 1964336
registers.r11: 1959232
registers.r8: 0
registers.r9: 347893268520
registers.rdx: 3716496
registers.r12: 0
registers.rbp: 0
registers.rdi: 0
registers.rax: 1
registers.r13: 0
1 0 0
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2816
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x000000007304c000
process_handle: 0xffffffffffffffff
1 0 0
Lionic Trojan.Win32.Convagent.4!c
DrWeb Trojan.SpyBot.1263
MicroWorld-eScan Gen:Variant.Zusy.477261
McAfee Artemis!74D702C79B98
Malwarebytes Malware.AI.2899400243
VIPRE Gen:Variant.Zusy.477261
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_90% (W)
Alibaba TrojanDownloader:Win32/Amadey.8be36d9e
Arcabit Trojan.Zusy.D7484D
Cyren W64/Zusy.RV.gen!Eldorado
Symantec ML.Attribute.HighConfidence
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/TrojanDownloader.Amadey.G
Cynet Malicious (score: 100)
ClamAV Win.Malware.Zusy-9985435-0
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Zusy.477261
Avast Win64:PWSX-gen [Trj]
Tencent Win32.Trojan.Agen.Fajl
Emsisoft Gen:Variant.Zusy.477261 (B)
F-Secure Heuristic.HEUR/AGEN.1301090
TrendMicro TROJ_GEN.R002C0DJ323
McAfee-GW-Edition BehavesLike.Win64.Dropper.th
FireEye Gen:Variant.Zusy.477261
Sophos Troj/Steal-DCI
Jiangmin Trojan.PSW.Stealer.cnb
Webroot W32.Trojan.Amadey
Avira HEUR/AGEN.1301090
MAX malware (ai score=89)
Antiy-AVL Trojan[Downloader]/Win32.Amadey
Microsoft Trojan:Win32/Amadey!ic
ViRobot Trojan.Win.Z.Zusy.1110016.J
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Gen:Variant.Zusy.477261
Google Detected
AhnLab-V3 Trojan/Win.Generic.R595469
ALYac Gen:Variant.Zusy.477261
Cylance unsafe
Panda Trj/GdSda.A
Rising Stealer.Convagent!8.1326D (TFE:5:7c4j9hQ2SPS)
Ikarus Win32.Outbreak
MaxSecure Trojan.Malware.300983.susgen
AVG Win64:PWSX-gen [Trj]
DeepInstinct MALICIOUS