cred64.dll
First submission 2024-10-16 20:48:02
File details
| File type: | PE32+ executable (DLL) (GUI) x86-64, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1255.5 KB (1285632 bytes) |
| Compile time: | 2024-02-19 22:01:41 |
| MD5: | 304e7afdf32dbcbdce75b6366103abcb |
| SHA1: | 5a2fd2e2fbd458a8492d18f234a9478bb913bbdd |
| SHA256: | b233f3010c7766641225a26b6a8e2df599310ab6595b1bc686b164ba508b568d |
| Import Hash : | 3eb70f83441fc8632e81bd6eb89f424d |
| Sections 7 | .text .rdata .data .pdata _RDATA .rsrc .reloc |
| Directories 5 | import export resource debug relocation |
File features detected
Anti VM
Signed
XOR
OSINT Enrichments
| Virus Total: | 56/79 VT report date: 2024-07-25 18:01:05 |
| Malware Type 1 | trojan |
| Threat Type 3 | zusy stealer amadey |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://185.11.61.121/h8s9k20gnb2/Plugins/cred64.dll  |
185.11.61.121 |
2024-10-16 20:48:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xfbef8 | 1032192 | 84c7150e0801b7543188893bd9095f908be4fddb | b4bcd44dec35a2daca9326b5ce77cbd8 | |
| .rdata | 0xfd000 | 0x2cde2 | 183808 | 81913c8f8ca8cb4cf04f81f6cbea045694c37901 | 725eea317c8a72eb17ce2bf9c99f5131 | |
| .data | 0x12a000 | 0xbb4c | 17408 | 47a8e09010ed26ceb5914b328a4315a37347ef35 | 02bd6deb3afde973ccfa6f7be4b2468d | |
| .pdata | 0x136000 | 0xad28 | 44544 | 9fed2f75f906a8594145647903a6b0df9c5af120 | a752966eb97c2d784e038894a37a13ef | |
| _RDATA | 0x141000 | 0x94 | 512 | 2d5ae0778d2ca9620bb763074e3551a0ae51c087 | a5995913394631ab4f6ef283137b5c9d | |
| .rsrc | 0x142000 | 0xf8 | 512 | 6f2aee814106277dae3a8e6b3254dde0bfde7fc7 | 193fc41b7ab2ce83170d116dba1ce3ac | |
| .reloc | 0x143000 | 0x15f4 | 5632 | ce84cdd3862451ee4c82d22aa290a14e260840bf | 6b255962cbf9942cc97cd613f7352d10 |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x142060 | 145 |
Anti debug functions 10
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringA |
| OutputDebugStringW |
| Process32FirstW |
| Process32NextW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Strings analysis - File found
| XML |
| FileZilla\sitemanager.xml |
| Psi\profiles\default\accounts.xml |
| \.purple\accounts.xml |
| .purple\accounts.xml |
| Library |
| mscoree.dll |
| KERNEL32.dll |
| bcrypt.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| WININET.dll |
| Crypt32.dll |
| STEALERDLL.dll |
| nss3.dll |
Strings analysis - Possible IPs found 1
| 3.8.7.4 |
Import functions
PE Exports 2 suspicious
| Function | Address |
|---|---|
| Main | 0x1800c11f0 |
| Save | 0x180005cf0 |
| Name | Latest seen | MD5 |
|---|---|---|
| cred64.dll | 2024-07-15 20:36:02 | b9bccd35addce48384491a98e1b89eb5 |
| cred64.dll | 2024-07-29 00:14:02 | d4944b1c2a2636220b189ab9b8dbbc00 |
| cred64.dll | 2024-08-28 07:05:02 | 4a4527a3ecf33ac8dc86e12681abf97b |
| cred64.dll | 2024-10-16 20:45:03 | d936bcd060924a3ea77c08a9fe550990 |
| cred64.dll | 2024-10-16 20:46:04 | 9bafe5c5cfe47a1ed2e15f2748986d92 |
| cred64.dll | 2024-10-16 20:47:03 | 1b32cdb682dc2b89bab7263aa4f1f08b |
| cred64.dll | 2024-10-16 20:49:04 | 86d2400fe6cf41987dc3d7431cbc1279 |