Xotmail - Hotmail Brute Checker.rar
- SHA256 488568106b52122b7887e248325ba0b51d3333f03768e86dc51b0bfb47dd527e
Password
333
Behavioral task
behavioral1
Sample
Xotmail - Hotmail Brute Checker.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Xotmail - Hotmail Brute Checker.rar
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target Xotmail - Hotmail Brute Checker.rar
- Size 4.1MB
- Sample260619-ysw4rsbs8q
- SHA256 488568106b52122b7887e248325ba0b51d3333f03768e86dc51b0bfb47dd527e
- MD5 090e21a8c617a0c4efa2793bad0280bf
- SHA1 ae29d5624fc7b7c5c853b51867769d036a2cbdc7
- SHA512 cef254d0d1c4bba6c668f72cf3538119f241314919adc8cfcb13552ca77d431fd7769a34a253db3620d327d68812b34d81a65c2f480ce169aae974fca844bbba
- SSDEEP 98304:evYpO+gau79m83ciZtIPz1Bb8ajj775QiuQ4TWlOxpI/+8rbDblN:evYpqpm8Mi3I71v5GRp4Xz
- TLSH T1431633AEB752E2C328CC57E1781E1E8F80D963247B07EF1444C37699CF4DE4AA49DA64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/Xotmail - Hotmail Brute Checker/Xotmail.exe upx - Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/Xotmail - Hotmail Brute Checker/Xotmail.exe unpack001/Xotmail - Hotmail Brute Checker/lib/x64/PyInjector-x64.dll unpack001/Xotmail - Hotmail Brute Checker/lib/x86/PyInjector-x86.dll
File Explorer
-
Xotmail - Hotmail Brute Checker.rar.rar 4.1MB
-
Xotmail - Hotmail Brute Checker/Xotmail.exe.exe 700.0MB
-
Xotmail - Hotmail Brute Checker/concrt140.dll244KB
-
Xotmail - Hotmail Brute Checker/config.ini116B
-
Xotmail - Hotmail Brute Checker/config.txt33B
-
Xotmail - Hotmail Brute Checker/lib/core.dll.ps1 1.8MB
-
Xotmail - Hotmail Brute Checker/lib/network.dll.ps1 730KB
-
Xotmail - Hotmail Brute Checker/lib/proxy.dll.ps1 471KB
-
Xotmail - Hotmail Brute Checker/lib/sqlite.dll507KB
-
Xotmail - Hotmail Brute Checker/lib/utils.dll398KB
-
Xotmail - Hotmail Brute Checker/lib/x64/PyInjector-x64.dll.dll 9KB
-
Xotmail - Hotmail Brute Checker/lib/x86/PyInjector-x86.dll.dll 9KB
-
Xotmail - Hotmail Brute Checker/msvcp140.dll536KB
-
Xotmail - Hotmail Brute Checker/vcruntime140.dll97KB
Xotmail - Hotmail Brute Checker/Xotmail.exe
- SHA256 275d73db22a95c6a8631546360a5aa1a7e66aacb0885e710fbb59ba627ad8ad1
- MD5 2860382c50d9e873d58757be11ad9cd5
- SHA1 e2256ff5a41502b269deaf310d68922af5e52d32
- SHA512 9dd467c23173e2be0550eae69ec69eb609f04e01af54e0d29fe2e6728933d13dac50ce1344703f0f7cfd6e2ca9055ed1d4b4346f7c5f9524b18951f09707b374
- SSDEEP 3072:2Ej5zFAim8Lj9pd5NDLzQp8dNd48y44ILGt0g:nFfFhBNHzVdN+6LHg
- TLSH T1BD79029ED00CB17CC99D94FE15592A34BEC5E422481E173F4B89EDA314AB68C77368F4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
296464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
Name
UPX0
Size
Virtual Size
188KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
UPX1
Size
101KB
Virtual Size
104KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
generic
count=160, id=261, version=33145,
count=17, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=1, id=262, version=33145,
count=86, id=261, version=35721,
count=13, id=257, version=33145,
count=134, id=1, productName=Unmarked objects,
count=1, id=265, version=36231,
count=1, id=255, version=36231,
count=1, id=258, version=36231,
Xotmail - Hotmail Brute Checker/concrt140.dll
- SHA256 1a9e21999b74d999099215d6bfae409fa13d50b54dd0060f1f0e8d3003971a41
- MD5 af31f50188c81f2a4cf9442fd75b2063
- SHA1 79dc573d9e3b5e0c6f97eff833df5bd3a1dc6e0d
- SHA512 43483a0fc1a86f4a0f868c48bf215f59a5e52f309779c0fe009925950c79b3a9d4e78cea1d1ed0c8e3ec35fbf73dff3b2099ce88f93f58efedca357bade5cd3b
- SSDEEP 6144:n6KxkxhLszSUXHDPWxC1k8Oach9t4ZUFELkzPMgzER:nVxkjoFXbA8k8Yhb4ZxyUK4
- TLSH T18A34228EE506B467196F6EE75503ECBE0D9FF5A7C41239803C6C22CC2668DABE754302
- MD5 SHA1 SHA512 SSDEEP TLSH
Xotmail - Hotmail Brute Checker/config.ini
- SHA256 43fe87f9b47bcf4681800f3721e94f3db3706450579c51a3b33d92a66b6ef45d
- MD5 803c3ae63fbb444034662fa949b82e86
- SHA1 57623fccdefe6cdb53ef6e0c8ec0a4baba77b68a
- SHA512 f38b62814faa4a3287d857270c1f81b82a2747a1b2111fa02b1185f9a280b6d6eee912edb65f86279542e9b05aa3fa94d9039c7dbcfe413904d3bf9a7716b69f
- TLSH T16CB0128057C2D8CC5CBD8D8649A054EB614FFFD40952CA4077123C776CCC44F120E85E
- MD5 SHA1 SHA512 TLSH
Xotmail - Hotmail Brute Checker/config.txt
- SHA256 1c5a7e7bd04539444eaa645700641a98450f4ea799ba81a30dd79d63de4f7a3c
- MD5 67c5cdf1ad1a82f1cf6f8f02e9ee71a3
- SHA1 ede81a9c7b2156335ef9b9b9927bda63acd87898
- SHA512 0225f08fb1edb8203bce84ceed875f5e81bb25be472efb3b43cbf4588f05a3d36193332bbd4eaa05c1b579284825577067c159f1587fa32c005b12371c8e8291
- MD5 SHA1 SHA512
Xotmail - Hotmail Brute Checker/lib/core.dll
- SHA256 d299aba3283316cb6666e5f2340b89613d5950660d09dabaa702e0a673fe6f59
- MD5 2263a91da7a4329f37e33f90ffb5afb4
- SHA1 ebcb5fc574c00cf32d50eb483ad118f7d90f2808
- SHA512 72902baaecd615ff91cbfbd8b019781529fe4660ce7496ccee8d0c337bced37a8549ecd0a5a4a7f048bd5c18b06b49adddf8f490ae7e3d11a8b1de643abe047e
- SSDEEP 49152:c6bynxIb24vf6J5Myp3cxmhh2qexZMc7ub5kBhKWwyksfle:rbY+DrKb5c+aoWrHle
- TLSH T1419533FE9A1A321931872E420F0FF6CB117579C721F7E4569171529A0A8A3206B3FBDD
- MD5 SHA1 SHA512 SSDEEP TLSH
Xotmail - Hotmail Brute Checker/lib/network.dll
- SHA256 bc516d771019d4d993611ddc00bee8754203a6bd30c6c5a74f48729acba8491d
- MD5 42107722b2fc475ba8307ff00989fd91
- SHA1 77692b8ba59f9cdfe559397384a97f4c28ca8302
- SHA512 f37ab2cf320d7af269f052df68e80bea583dba92d670e2b1632df73ebf7d8f20eb019ec9932aa67e8a90e4bb299c78cc981dc52209c4f440db08eca4d68cfd95
- SSDEEP 12288:ZKczApzF/4aOejvN/k70abl0xMp6YtIJKUuRvl4djOww+5xUoOvrcF+3K:UczQ/4U1/k7lbyxS1tuKXvSKnIUXvrcH
- TLSH T1B5F433CDCA571D5CF91533D8E09A5618F6721E0E4CA0FFDC932F39E6444B2EA586A843
- MD5 SHA1 SHA512 SSDEEP TLSH
Xotmail - Hotmail Brute Checker/lib/proxy.dll
- SHA256 8e5be70129c8ddf6fc88235c69d258ee29a5ebd59ec5244bc1a00a52bfdfd52c
- MD5 f192c830eda606e99e60d3f595bd1044
- SHA1 b3aae6b0cb3d902e6c9f3e3e791b04013b8c4dd7
- SHA512 3cf0795c3c276358c8a5a92dd3591da79bebd538db1bd22871bb1b0ae5554da12d82a6ab6668d1e6fdaec993a10ca1a51be98d606cf8a7f9232131c1c7c80b25
- SSDEEP 12288:MTMhgtuswCLq7k8G5h6Xgsylh5LO+Oak0bcQuTGH5:kprwCGBiXsyly+Lk0bcQBH5
- TLSH T1DDA423760F49CFFA0851423634A4CB8834FA255F3E286294CD99B76E22B16C73F96F51
- MD5 SHA1 SHA512 SSDEEP TLSH
Xotmail - Hotmail Brute Checker/lib/sqlite.dll
- SHA256 7984af389a87b00c5a3928f1fdec4df4db3755f42eeee91f9d479593e9829994
- MD5 6b1ea9d5c412437139fc596794b6a26a
- SHA1 7beebba737515dfcfe959f313eb14f68d18144eb
- SHA512 fffae97b104362161ebedd8ba97c989010f27a0f8c8e7c8afe9011fdd02261fd3f13e59074dd3e7052e597952d777a285aee32a1e709a4ff2f7cc2c5aa6e343b
- SSDEEP 12288:FmIMqA4SiGZVyeR3sunYYSoD4PUkAJKlCoJjlPfu5EPLViyuw3+Z1+u:4IjAfWU3sjxnMJKll5BPYj1Z1x
- TLSH T138B42350238A87F1800AE56B6B1CAB420C35E9DFA2796D19EEC93753D0B9361F345D2F
- MD5 SHA1 SHA512 SSDEEP TLSH
Xotmail - Hotmail Brute Checker/lib/utils.dll
- SHA256 eff15cf13720c62adb5faa6c3c80c3a8661c61900691c64a740d96bace5facfe
- MD5 13ef1738781a5dc886e29aca53d26a47
- SHA1 f273242be627f743e41f4b528aded3c27f92929c
- SHA512 259cdf7cdd7a9b76234524768fa06b358a0f4bffdef093144d369747a60784f63bfc5c81836ebba7dd67b5a6ae1c748189b8c19dc15c4e34da355115c6a087bb
- SSDEEP 6144:6FYshWkzsqwqFRyiW4/QMysL92NYmLS5omyE2pHBAOokeGHgLyERWu4/AqoxmqDd:rTks1iRVvL92pmooQALyERH8Aq/4
- TLSH T1F4842387F836EDC1F8CA010B217D81ED8B608505779A6926F4ED92C75C7EF4B96C8293
- MD5 SHA1 SHA512 SSDEEP TLSH
Xotmail - Hotmail Brute Checker/lib/x64/PyInjector-x64.dll
- IMPHASH e5347ffbc382ffb4185524d15ba1bae7
- SHA256 0839d2cba232d4219b7e70bc5c8eaeff53a2719750b1c0dabd2b68bc4099274d
- MD5 3134f8652d4229607bffe7b993f19d15
- SHA1 5c51ae7856aa80e3db1a582e6870ece9f9a81485
- SHA512 82c1514f8579ee9a95d757754e2ae6c832930bd72b8e7fea6be68c36f9857a9424e2b6776d54d21edaef5085f1699861bba2a459eaf54eb60677a760a61cb8ee
- SSDEEP 192:TCpiKgiXRepdwFNW08AWJzmqjOcupOWebm7ua+3MWr:TCpVzywJ4JSqjZ4kJr
- TLSH T1D0121AE7FFD94DE2CF6C03BABD76542F4AACBB500F90062267E556040A1A442F83455E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
333
Minor OS version
0
Major OS version
6
Entry point
5264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\jacks\Downloads\PyInjector-main\PyInjector-main\Release\PyInjector.pdb
kernel32
FreeLibraryAndExitThread
CloseHandle
CreateThread
GetModuleHandleA
GetProcAddress
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
vcruntime140
memset
_except_handler4_common
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_dll
_initterm_e
_initterm
_initialize_narrow_environment
_initialize_onexit_table
_configure_narrow_argv
_execute_onexit_table
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=32533,
count=10, id=261, version=32533,
count=10, id=260, version=32533,
count=1, id=259, version=32533,
count=3, id=257, version=30795,
count=35, id=1, productName=Unmarked objects,
count=2, id=265, version=32919,
count=1, id=255, version=32919,
count=1, id=258, version=32919,
Xotmail - Hotmail Brute Checker/lib/x86/PyInjector-x86.dll
- IMPHASH e5347ffbc382ffb4185524d15ba1bae7
- SHA256 0839d2cba232d4219b7e70bc5c8eaeff53a2719750b1c0dabd2b68bc4099274d
- MD5 3134f8652d4229607bffe7b993f19d15
- SHA1 5c51ae7856aa80e3db1a582e6870ece9f9a81485
- SHA512 82c1514f8579ee9a95d757754e2ae6c832930bd72b8e7fea6be68c36f9857a9424e2b6776d54d21edaef5085f1699861bba2a459eaf54eb60677a760a61cb8ee
- SSDEEP 192:TCpiKgiXRepdwFNW08AWJzmqjOcupOWebm7ua+3MWr:TCpVzywJ4JSqjZ4kJr
- TLSH T1D0121AE7FFD94DE2CF6C03BABD76542F4AACBB500F90062267E556040A1A442F83455E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Password
333
Minor OS version
0
Major OS version
6
Entry point
5264
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\jacks\Downloads\PyInjector-main\PyInjector-main\Release\PyInjector.pdb
kernel32
FreeLibraryAndExitThread
CloseHandle
CreateThread
GetModuleHandleA
GetProcAddress
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
vcruntime140
memset
_except_handler4_common
__std_type_info_destroy_list
api-ms-win-crt-runtime-l1-1-0
_cexit
_seh_filter_dll
_initterm_e
_initterm
_initialize_narrow_environment
_initialize_onexit_table
_configure_narrow_argv
_execute_onexit_table
Name
.text
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
512B
Virtual Size
932B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
388B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=257, version=32533,
count=10, id=261, version=32533,
count=10, id=260, version=32533,
count=1, id=259, version=32533,
count=3, id=257, version=30795,
count=35, id=1, productName=Unmarked objects,
count=2, id=265, version=32919,
count=1, id=255, version=32919,
count=1, id=258, version=32919,
Xotmail - Hotmail Brute Checker/msvcp140.dll
- SHA256 4b7dc0b719490dfae1e1fc0d29513138f0be812936c21fa07a7bf61261d265c2
- MD5 06c084935e4fe94e65f2f3a2fc525784
- SHA1 0cbc7066da3731e46d926db7471afee1c4df327a
- SHA512 16ba2905b8f113f1b5791a1241c814071810eb888ccff3b963d1bdca08165be376c885903d9f3bbad9bbec5f41bd56bfec43d020967a104105c9897777aaee03
- SSDEEP 12288:ItgfG2uPmPMa/NAXt+hgqARP0mOISADCN2NW0SrNYnkQsN+Bbg6:gwGtPmF2Cfu8mVPDCN2NWprNIkxIbg6
- TLSH T149C423A66C303FD5A6D072D0E9D41BDD63BF6DBB620EAD6464FA40C2627288D3181D7C
- MD5 SHA1 SHA512 SSDEEP TLSH
Xotmail - Hotmail Brute Checker/vcruntime140.dll
- SHA256 7035c7989ec7f9fb1878145c63cbea08cd8293437489c948ac61800963719d11
- MD5 56209c53e39a8f0ee87b7466b52fe932
- SHA1 49351bcc8c5b612882395f9ed704f8b1986235e4
- SHA512 4f3066c08246278ec340b3e719cc7b63cd4f953b90b60c3f4c4e6283c6afc555daaa47b03d5a0e495606f9f98e7ef3ac4845d4e0315ef1558826a414b1ba48a2
- SSDEEP 3072:YKQOBG/ISjTtXbCptqn6DSeFu66xvTJv5YOxZFPy:YzA2GptqnaSeFunJv/75y
- TLSH T1B2A30228D916B6730836654046CAFF7D84A480363EAF9B939F43F91867E4CB955C8923
- MD5 SHA1 SHA512 SSDEEP TLSH