9ecafc8f4be7ece39b55c267992d8a97bd66c049fe72f729bdd64eb9c6cd1e4d | Triage

Submit
Reports

Overview

overview

Static

static

BouncyCast...to.dll

windows10-2004-x64

1

Client.exe

windows10-2004-x64

Gma.System...ok.dll

windows10-2004-x64

1

Kira.exe

windows10-2004-x64

Microsoft....es.dll

windows10-2004-x64

1

Microsoft....im.dll

windows10-2004-x64

1

Microsoft....er.dll

windows10-2004-x64

1

Microsoft....ce.dll

windows10-2004-x64

1

Microsoft....es.dll

windows10-2004-x64

1

Microsoft....ns.dll

windows10-2004-x64

1

Microsoft....rk.dll

windows10-2004-x64

1

Mono.Cecil.Mdb.dll

windows10-2004-x64

1

Mono.Cecil.Pdb.dll

windows10-2004-x64

1

Mono.Cecil.Rocks.dll

windows10-2004-x64

1

Mono.Cecil.dll

windows10-2004-x64

1

Open.Nat.dll

windows10-2004-x64

1

Quasar.Com...ts.dll

windows10-2004-x64

1

Quasar.Common.dll

windows10-2004-x64

1

Vestris.Re...ib.dll

windows10-2004-x64

1

client.exe

windows10-2004-x64

protobuf-net.dll

windows10-2004-x64

1

Analysis

max time kernel
101s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
04/04/2025, 16:13

Sharing

Static task

static1

3 signatures

Behavioral task

behavioral1

Sample

BouncyCastle.Crypto.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral2

Sample

Client.exe

Resource

win10v2004-20250314-en

quasar spyware trojan

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral3

Sample

Gma.System.MouseKeyHook.dll

Resource

win10v2004-20250313-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral4

Sample

Kira.exe

Resource

win10v2004-20250314-en

orcus discovery rat spyware stealer

windows10-2004-x64

13 signatures

150 seconds

Behavioral task

behavioral5

Sample

Microsoft.TestPlatform.AdapterUtilities.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral6

Sample

Microsoft.VisualStudio.CodeCoverage.Shim.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral7

Sample

Microsoft.VisualStudio.TestPlatform.MSTest.TestAdapter.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral8

Sample

Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.Interface.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral9

Sample

Microsoft.VisualStudio.TestPlatform.MSTestAdapter.PlatformServices.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral10

Sample

Microsoft.VisualStudio.TestPlatform.TestFramework.Extensions.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral11

Sample

Microsoft.VisualStudio.TestPlatform.TestFramework.dll

Resource

win10v2004-20250313-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral12

Sample

Mono.Cecil.Mdb.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral13

Sample

Mono.Cecil.Pdb.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral14

Sample

Mono.Cecil.Rocks.dll

Resource

win10v2004-20250313-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral15

Sample

Mono.Cecil.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral16

Sample

Open.Nat.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral17

Sample

Quasar.Common.Tests.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral18

Sample

Quasar.Common.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral19

Sample

Vestris.ResourceLib.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Behavioral task

behavioral20

Sample

client.exe

Resource

win10v2004-20250314-en

quasar spyware trojan

windows10-2004-x64

4 signatures

150 seconds

Behavioral task

behavioral21

Sample

protobuf-net.dll

Resource

win10v2004-20250314-en

windows10-2004-x64

0 signatures

150 seconds

Report Analysis Logs

General

Target

BouncyCastle.Crypto.dll
Size

3.2MB
MD5

0cf454b6ed4d9e46bc40306421e4b800
SHA1

9611aa929d35cbd86b87e40b628f60d5177d2411
SHA256

e51721dc0647f4838b1abc592bd95fd8cb924716e8a64f83d4b947821fa1fa42
SHA512

85262f1bc67a89911640f59a759b476b30ca644bd1a1d9cd3213cc8aae16d7cc6ea689815f19b146db1d26f7a75772ceb48e71e27940e3686a83eb2cf7e46048
SSDEEP

49152:JIBbo0WIgmjljFtXCdRLRBcJd+KaGxHIkMNqzP56O8lZ7qXUqi9Y:6BbBWIgWljGxRB/LLY

Score

1^/10

Malware Config

Signatures

Processes

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\BouncyCastle.Crypto.dll,#1
1⤵
PID:448

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

© 2018-2025

Terms | Privacy