Overview
overview
3Static
static
3out/crymor...er.exe
windows10-2004-x64
1out/crymor...er.exe
windows11-ltsc_2024-x64
1out/runtim...ny.dll
windows10-2004-x64
1out/runtim...ny.dll
windows11-ltsc_2024-x64
1out/smi/Sh...or.dll
windows10-2004-x64
1out/smi/Sh...or.dll
windows11-ltsc_2024-x64
1out/smi/smi.exe
windows10-2004-x64
1out/smi/smi.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 22:22
Static task
static1
Behavioral task
behavioral1
Sample
out/crymore-loader.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
out/crymore-loader.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
out/runtime/0Harmony.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
out/runtime/0Harmony.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
out/smi/SharpMonoInjector.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
out/smi/SharpMonoInjector.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
out/smi/smi.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
out/smi/smi.exe
Resource
win11ltsc2024-20260709-en
General
- Target out/crymore-loader.exe
- Size 878KB
- Sample260818-2amn6attfv
- SHA256 e8f43c5e3cad78a9f64d66109bba135573c09a0b0a6c5fceaf4a5d282d76d0de
- MD5 49a497e805e80a6cd8cee4d48f496df2
- SHA1 3caa30070568e3ee40e28d951247eaaf1a187d56
- SHA512 414facefde1cbab2c6843f587584d0706b324a9c335602c82736a42e79ab7ef61622c02dde1e03e0b07ba4389e572516e64a0e8714319ca10fa344d1a392d7ce
- SSDEEP 12288:EzEwUZ8yyD+GdkwGY7KLN3VeWXYI29KJq7YWVxQ4qGYivnGAto6:EzsZ8tWwAVVlXILYWVuhivnGA
- TLSH T18815BF4AB2F801FDD4AB9138CA5A5A1BE675345907308ADF13F446A43FA72E05FBE311
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3692 crymore-loader.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3692 crymore-loader.exe