out.zip
- SHA256 e0a5e1014e37414ace2a962f21d4adc95ae8f027c77ec5aff28687af2e5fe4c5
Overview
overview
3Static
static
3out/crymor...er.exe
windows10-2004-x64
1out/crymor...er.exe
windows11-ltsc_2024-x64
1out/runtim...ny.dll
windows10-2004-x64
1out/runtim...ny.dll
windows11-ltsc_2024-x64
1out/smi/Sh...or.dll
windows10-2004-x64
1out/smi/Sh...or.dll
windows11-ltsc_2024-x64
1out/smi/smi.exe
windows10-2004-x64
1out/smi/smi.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
out/crymore-loader.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
out/crymore-loader.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
out/runtime/0Harmony.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
out/runtime/0Harmony.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
out/smi/SharpMonoInjector.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
out/smi/SharpMonoInjector.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
out/smi/smi.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
out/smi/smi.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target out.zip
- Size 1.5MB
- Sample260818-2amn6attfv
- SHA256 e0a5e1014e37414ace2a962f21d4adc95ae8f027c77ec5aff28687af2e5fe4c5
- MD5 ccfac5df2657f67c4179c076ff14703f
- SHA1 bd5e3ac8a3705c9c061f9e127128b8372b846bb9
- SHA512 6835d239c68e867eb9df806b589f40a25f1d7769c7aa0267ef40dc2c656e00a0b01d2e9fcd8d219ce8ad19a31d2c3ba164a3a2b00d5fa6c9178c46fd8da391e6
- SSDEEP 24576:T1V9fQY6zymkFJdCXMLRjlQZvl6Mxef8+7O8u3ZFDlYDDC8HsgpRl:RVmryxZLLRjuZtEfZ7OXPDl6WgV
- TLSH T1DB753329C3D7E384DBAAB1FC2AFA1F458117F0C641CA65DBF9A5C93AE9D4C50B082474
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 4 IoCs
Checks for missing Authenticode signature.
resource unpack001/out/crymore-loader.exe unpack001/out/runtime/0Harmony.dll unpack001/out/smi/SharpMonoInjector.dll unpack001/out/smi/smi.exe
File Explorer
-
out.zip.zip 1.5MB
-
out/crymore-loader.exe.exe 878KB
-
out/fonts/Regular.ttf323KB
-
out/fonts/SemiBold.ttf326KB
-
out/runtime/0Harmony.dll.dll 2.3MB
-
out/runtime/0Harmony.xml.js .xml 292KB
-
out/smi/SharpMonoInjector.dll.dll 22KB
-
out/smi/readme.txt44B
-
out/smi/smi.exe.exe 9KB
out/crymore-loader.exe
- IMPHASH 5cc8c4a0e8e4c3f77a7e583cab677fab
- SHA256 e8f43c5e3cad78a9f64d66109bba135573c09a0b0a6c5fceaf4a5d282d76d0de
- MD5 49a497e805e80a6cd8cee4d48f496df2
- SHA1 3caa30070568e3ee40e28d951247eaaf1a187d56
- SHA512 414facefde1cbab2c6843f587584d0706b324a9c335602c82736a42e79ab7ef61622c02dde1e03e0b07ba4389e572516e64a0e8714319ca10fa344d1a392d7ce
- SSDEEP 12288:EzEwUZ8yyD+GdkwGY7KLN3VeWXYI29KJq7YWVxQ4qGYivnGAto6:EzsZ8tWwAVVlXILYWVuhivnGA
- TLSH T18815BF4AB2F801FDD4AB9138CA5A5A1BE675345907308ADF13F446A43FA72E05FBE311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
549288
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
winhttp
WinHttpReceiveResponse
WinHttpConnect
WinHttpCrackUrl
WinHttpQueryDataAvailable
WinHttpCloseHandle
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpOpen
WinHttpReadData
WinHttpOpenRequest
WinHttpSetOption
kernel32
GetModuleHandleA
Sleep
QueryPerformanceFrequency
GetProcAddress
ExitProcess
QueryPerformanceCounter
GetTickCount
IsDebuggerPresent
CheckRemoteDebuggerPresent
OutputDebugStringA
MultiByteToWideChar
GlobalAlloc
GlobalFree
GlobalLock
WideCharToMultiByte
GlobalUnlock
GetLocaleInfoA
LoadLibraryA
IsDBCSLeadByte
VerSetConditionMask
GetModuleHandleW
FreeLibrary
CreateToolhelp32Snapshot
GetLastError
Process32NextW
DeleteFileA
Process32FirstW
CloseHandle
ReadFile
SetHandleInformation
WaitForSingleObject
GetFileAttributesA
QueryFullProcessImageNameA
GetExitCodeProcess
GetCommandLineA
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetFileSizeEx
GetConsoleOutputCP
FlushFileBuffers
ReadConsoleW
GetCurrentProcess
SetFilePointerEx
LCMapStringW
VirtualProtect
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetFileType
HeapAlloc
HeapFree
WriteFile
GetStdHandle
GetModuleFileNameW
GetModuleHandleExW
FreeLibraryAndExitThread
ExitThread
CreateThread
LoadLibraryExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
SetStdHandle
GetStringTypeW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
CreateFileW
HeapSize
HeapReAlloc
WriteConsoleW
SetEndOfFile
GetConsoleMode
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
DeleteCriticalSection
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
WaitForSingleObjectEx
GetExitCodeThread
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeCriticalSectionEx
GetSystemTimeAsFileTime
EnterCriticalSection
LeaveCriticalSection
user32
ReleaseCapture
GetCursorPos
GetClipboardData
UpdateWindow
GetWindowLongW
AdjustWindowRectEx
GetKeyState
GetMessageExtraInfo
SetPropA
GetDC
MonitorFromWindow
SetWindowLongPtrW
EnumDisplayMonitors
ScreenToClient
WindowFromPoint
GetCapture
IsChild
TrackMouseEvent
GetKeyboardLayout
GetForegroundWindow
GetPropA
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
SetCursor
SetWindowLongW
GetClientRect
IsWindowUnicode
SetForegroundWindow
IsIconic
SetCursorPos
ReleaseDC
OpenClipboard
CloseClipboard
EmptyClipboard
PostQuitMessage
SetClipboardData
DefWindowProcW
MonitorFromPoint
SetProcessDpiAwarenessContext
GetWindowRect
DestroyWindow
SetWindowPos
MessageBoxW
GetDpiForWindow
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
DispatchMessageW
GetMonitorInfoW
ClientToScreen
PeekMessageW
TranslateMessage
LoadCursorW
SetCapture
gdi32
GetDeviceCaps
advapi32
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
shell32
ShellExecuteW
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
Name
.text
Size
692KB
Virtual Size
691KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
149KB
Virtual Size
149KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
4KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
28KB
Virtual Size
27KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=165, id=261, version=33145,
count=22, id=260, version=33145,
count=15, id=259, version=33145,
count=2, productName=Unmarked objects (old),
count=16, id=260, version=33030,
count=18, id=259, version=33030,
count=60, id=261, version=33030,
count=21, id=257, version=33145,
count=234, id=1, productName=Unmarked objects,
count=12, id=265, version=33145,
count=1, id=255, version=33145,
count=1, id=258, version=33145,
out/fonts/Regular.ttf
- SHA256 ef9cf99f0175bef530b88934bd904fcf56f773cec6fd4dfb8ccaf7ce2bbd395e
- MD5 203d753a80557746c23ce95191fbf013
- SHA1 ec13ef1f2c99f8780d6f2eb3f9f27ef89f30161b
- SHA512 6e550ce93625419a15dae4f59966c18e26ae8cdcb54bf729de900463221fe33dfebd15777c87d5c49595daddfd908f448c16420f4c6432190fdb0ed99906a294
- SSDEEP 6144:gNOIple1FXzYAOr387HRMsIHYuMYRU0vII9z6VTNGeNr:NFXzc74yz6tNnNr
- TLSH T107644B02BF06676DD5462D36DBB1C3B8B772BE607F5D824BF48B6798E48F4B40984284
- MD5 SHA1 SHA512 SSDEEP TLSH
out/fonts/SemiBold.ttf
- SHA256 9c4db3814875410e7d64fdc8e69676c3b84968bb15bf3ace8b3944c59fbc56b6
- MD5 c1bd726715a688ead84c2dbf4c82f88d
- SHA1 79f74616d68b87d6cf89798fe72259036326567a
- SHA512 488b7b04cc03f92dd23823c356414fee745b5f1848491d25f8a7bde36cc8b045f2c724820dedecc09c2a07f2e02b841362d1a7e44de9c517e7813daf5a73cad1
- SSDEEP 3072:juN2JjhEMw0tzpQCcfjg1bsxsKWt4ABDnLeSk4R42xNEYq3Y6MYrkwn+imOTeAx+:qNLBe0BSzjXEdIxfGMpw4EPMaylyPK
- TLSH T1D1643C02BA06976DD4462D3AD7B1C3B87771FE617F59920BF8CA6AE8E4CF5A40C40285
- MD5 SHA1 SHA512 SSDEEP TLSH
out/runtime/0Harmony.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 77e6901ecc606aec66c2a972782a3779e4f50c037d2d165eb7ececdd4d8f794d
- MD5 b1e78041026ca8afeccd8842e6395ec3
- SHA1 817e2e50082541902008254ca77dc19432cff336
- SHA512 7ab63d2e3490d5d9065a5e19dd8c35e2ca4d1e95e224cd2014b5419e128bd4fd697f8000f19ddae5efb658b94da7df29fc0106f41c76df9caceafe5c184681cd
- SSDEEP 49152:4MyNeGcWVFN/MK0SZWJxKapVzgx6Ar9QuyyR:YeGcWVFN/MK0SUJ4a3g
- TLSH T14FB56B10B7E9EF26C59E4B36D0B3021957F1D9CB5346D7A72A40A67CAC83356AD023F2
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
2467150
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
C:\Users\Brrainz\Source\Repos\Harmony\Lib.Harmony\bin\Release\net48\ILRepack-22908-190659\0Harmony.pdb
mscoree
_CorDllMain
Name
.text
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
out/runtime/0Harmony.xml
- SHA256 5acc36197d7a82c8db7b98f6c9c8179369866ab9b126e4443d84466059e16899
- MD5 eaf96758123c5829723bf67d1bb2b8e3
- SHA1 906a7e006721a71d58f59b548d4c7f937a167a3c
- SHA512 e6502eb1aa7ebddd41b58442b6bf5201cb4dff3dff818344df182413e47cb73054264d3ae494271e07cae4ab6e12c6dcd917ded9f8b5beecdd50df42d713f045
- SSDEEP 3072:cjntmNhTFqkOEwBXOnK7YhpKAYI3iQ1UrpvZBgWy:U+hJqkhwBXOnK7YhQI3iQ1Urpvry
- TLSH T1335420A83AC5AA120C7602955D5DF8C8FF258C33311E1C5238CD7D636F7AEE282BB516
- MD5 SHA1 SHA512 SSDEEP TLSH
out/smi/SharpMonoInjector.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 29217632db48464afb84f163f6d389af525edb7e951384ff5ea91d91c932ee96
- MD5 d5f8ef2cdc4323ddd7845c9b90e4c6fd
- SHA1 fb40ced0fe0ba5bc83b0edc381c1c475ff773ff8
- SHA512 cd6efd9093b1b4ab867f0098e281655bd28af721f3a45efcfd9771174dc47dbc05e63e5d80e10296881facc7e100b834501c3bba4088e8bde3db6f88d9e27ad2
- SSDEEP 384:bNQjEDfKh78RjUV/wWWbSYNCi1ssza2Q6OgxMDfd/Wjp9zDqPD6eSFjgii/:JpqlwFmYNTxzepBW1nQ
- TLSH T146A2E604B3FC5A63F5FF4EB4A473224047B2F5A16422D75D0CD852E9AA237944B22BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
29118
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\projects\SharpMonoInjector\src\SharpMonoInjector\obj\Release\netstandard2.0\SharpMonoInjector.pdb
mscoree
_CorDllMain
Name
.text
Size
20KB
Virtual Size
20KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
876B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
out/smi/readme.txt
- SHA256 91de2efb66bcc91ff3a089b8bbec0379dac9018982b5507069e852bc96434ffe
- MD5 a2bb3f206a566589aca206cbfa5e69e5
- SHA1 d83c9a78ab4ed38b3374afe3465835ed700df764
- SHA512 f129085d8a0405de5ba0752fc45411aa7170596b31a45376e45931b602e037a3a1e7546e7742c42aaf64486db56770562c97114eb215d93ab1f84141161489b8
- MD5 SHA1 SHA512
out/smi/smi.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 12237476dfd8719929253c316091079d37d7ee8c6f630020b2b0a9996b036764
- MD5 c0a17812234aae6cd4365c67ec39a842
- SHA1 0c141a692d0f67cc1c62dac14f303d4b1447187e
- SHA512 84452a8b7e70abf4d2131f7fc451589b5aede332360b3834537bff012394be4f9e289fc893064027869cbda9d53cfe7c7793228c3adc98552ed5e30a8e4e4cae
- SSDEEP 192:JFebesSStElZcSBJKU9XtP1F2zdJJxuCnx:rebesHElSU3NAJd
- TLSH T1CD126251A6F84123E9FB7F3DA87653108B75BA69AC77CB2D1081526E0E52B408D32B73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
14382
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\projects\SharpMonoInjector\src\SharpMonoInjector.Console\obj\Release\smi.pdb
mscoree
_CorExeMain
Name
.text
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ