cred.dll
First submission 2024-10-16 21:00:02
File details
| File type: | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows |
| Mime type: | application/x-dosexec |
| File size: | 1059.5 KB (1084928 bytes) |
| Compile time: | 2024-10-09 14:37:09 |
| MD5: | b3d199fd9fa4a18f08d4aa9e17181869 |
| SHA1: | 5118db1803592b227541b3ac60ca04814a9fd793 |
| SHA256: | 21a08e2c8f67a1afeaa420280086d0cfd86b7829e97f2a6a7a362546ad2b6c6d |
| Import Hash : | 213cc311d974657ce4f52e13b2302f94 |
| Sections 5 | .text .rdata .data .rsrc .reloc |
| Directories 5 | import export resource debug relocation |
File features detected
Signed
XOR
OSINT Enrichments
| Virus Total: | 57/77 VT report date: 2024-10-15 17:04:17 |
| Malware Type 3 | trojan downloader spyware |
| Threat Type 3 | amadey lazy stealer |
URLs, FQDN and IP indicators 1
| URL | Host (FQDN/IP) | Date Added |
|---|---|---|
hXXp://78.153.139.168/gfj38cHcw/Plugins/cred.dll  |
78.153.139.168 |
2024-10-16 21:00:02 |
PE Sections 0 suspicious
| Name | VAddress | VSize | Size | SHA1 | MD5 | Suspicious |
|---|---|---|---|---|---|---|
| .text | 0x1000 | 0xe3ee8 | 933888 | 656977c8aeeb82adfeb6c76e4303de6455a0eb99 | c9996fe87f0d33b0e0ff73a0f7200712 | |
| .rdata | 0xe5000 | 0x1aee2 | 110592 | 2d86b9b0a4dd8f1ce2d4027bfbe320309c7d8d03 | 52c6ef92b1232b9246cdcc90009e2725 | |
| .data | 0x100000 | 0x8f3c | 11264 | 2a59530251e56b631aead7325344c79c3911ef93 | 57d5422df62ff375150c6f0773c343fd | |
| .rsrc | 0x109000 | 0xf8 | 512 | 559dd1af6be9b7f0e774e38607b61734b83898f4 | ac715e79d7a1c770f83f459c3488063f | |
| .reloc | 0x10a000 | 0x6a64 | 27648 | e6be663deff233613367c4a92ad781317ce6c13d | d1e47439caacd2f1426cf616beafd71b |
PE Resources 1
| Name | Language | Sublanguage | Offset | Size | Data |
|---|---|---|---|---|---|
| RT_MANIFEST | LANG_ENGLISH | SUBLANG_ENGLISH_US | 0x109060 | 145 |
Packers detected 1
| Borland Delphi 3.0 (???) |
Anti debug functions 10
| GetLastError |
| IsDebuggerPresent |
| IsProcessorFeaturePresent |
| OutputDebugStringA |
| OutputDebugStringW |
| Process32FirstW |
| Process32NextW |
| RaiseException |
| TerminateProcess |
| UnhandledExceptionFilter |
Anti debug functions 1
| VMCheck.dll |
Strings analysis - File found
| XML |
| Psi\profiles\default\accounts.xml |
| FileZilla\sitemanager.xml |
| \.purple\accounts.xml |
| .purple\accounts.xml |
| Library |
| mscoree.dll |
| KERNEL32.dll |
| ADVAPI32.dll |
| SHELL32.dll |
| WININET.dll |
| Crypt32.dll |
| STEALERDLL.dll |
| nss3.dll |
| bcrypt.dll |
Strings analysis - Possible IPs found 1
| 3.8.7.4 |
Import functions
PE Exports 2 suspicious
| Function | Address |
|---|---|
| Main | 0x100b1100 |
| Save | 0x100045c0 |
| Name | Latest seen | MD5 |
|---|---|---|
| cred.dll | 2024-07-21 09:03:01 | 765ad3b71d73ed1ae9e4fb004876837e |
| cred.dll | 2024-07-29 00:15:02 | d696e4ee5dac5d3e4b5073359224fcdc |
| cred.dll | 2024-10-16 21:17:02 | 13c5fbf7e0d1ea910bf55a32a877217f |
| cred.dll | 2024-10-16 21:18:02 | 16ab3210260ec2df7ffc2292e9ad4abb |
| cred.dll | 2024-10-16 21:19:03 | 0961bd2ba614e84e0b9b93444179fb07 |
| cred.dll | 2024-10-16 21:20:03 | 7c5bea5cda7a89450f82fa18497a0191 |