2b4e3692a542d1bad5cd2386caac14c32f177793dbe5c046c1b446a0b179b100

Resubmissions

08/08/2026, 15:26

260808-svj94attfs8

08/08/2026, 15:14

260808-smflyaeb258

Sharing

Copy URL Twitter E-mail

General

Target
BypAI.zip
Size 7.2MB
Sample260808-smflyaeb25
SHA256 2b4e3692a542d1bad5cd2386caac14c32f177793dbe5c046c1b446a0b179b100
MD5 68beaf9d63927139b15a033c3a46e49c
SHA1 c2490e1142a1176f64988134c9aa7159b98821e5
SHA512 d15bac2145f6c9775b55808d1a659f628c301f97cc0464f482d65ddd7cc36e42b6dc56b792d4cb704416e14e1575308906a7dddc0910d0f4e9b01fb44d8ded7d
SSDEEP 196608:KYVYCCV8huO5s9f2Wy3kCEB77Tkl6Y2+HwwbiWmvFNCarr:KYFCV0uD9foIK6lCwz/vN
TLSH
T1E576335C2E2D39E9F1334B32E58B23BA048E45CD5E35D21B544FD059BE841BACBB91E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  BypAI/BypAI-Client.dll
- Size 2.3MB
- SHA256 02df1eabae98dd656879809dede61e217e69616109abc12db25380add5056437
- MD5 94b2d9762e75f46538076523621d60aa
- SHA1 1f549e2c070bb171880bcdc1d39438553afeec7f
- SHA512 add4f3bb8d8c8a2f7db4ed1e0c9041e8771aeafc6b22dc6b4a4cdbe8e7d2fdfdaca440394b219f4b7eeef930c3b023f215cbf3a774a23d845c0409332d6c2e44
- SSDEEP 49152:EVrvyRj53VvZNPX/OevRObK0ygYFQ2iE17H6rNK6WDlUvJf:EV23nX/FvcbKJgYIE1gbJ
- TLSH
  T176B5227D23B84F22EABF5B36A8700915877AB016D9BDD3AD09C564ED1997B00DC203E7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery persistence ransomware
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral1 behavioral2
- Target
  costura.dll
- Size 5KB
- SHA256 6771700a3bbd39251648d73bae181c3a4fa978ac40cccf4d5e2ac7815f18b406
- MD5 27180a8ccb9c7d93bc5e1a95d67d3dbe
- SHA1 31531eea4711cf48d5e834ff92738769389ee1cd
- SHA512 f7ef2014320f82ff98c825b90a7229d74fe39b0e33fa7826b35f214dd5c51918c61e63acae8c19c42d817bd6ad571c9983766516c791b304db697df9dc5cf564
- SSDEEP 48:6vP2nhx3BTjtRiaAVLEF4iZ6iMtTg706YElaWTJFu2FY+cYH6AWk1qyFVw2Ib8:JHtRYVLE4YjYELTru2FZFWv2
- TLSH
  T1A6B1FB28A7B8533BEF7BCB72585353804374BD10D92B5B1F1AC562172C323948931722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  imgui.net.dll
- Size 310KB
- SHA256 1b519dba38e8ff0ae85721086c0646c7589c7772b80bf2297a3e8ead1f2a1c41
- MD5 123a9fb252a4efcafaaf89885b947019
- SHA1 9e7e40c5bf2cca57057faa6dbebf4ace79793dcd
- SHA512 dd473131e20129a35fef00d5204235013fa91441f81f938c08a14797b3d33b61da397e5a9849775469388a1e3471a17be078a18d0905649a8a504e9a3ebb5b20
- SSDEEP 6144:1Lzcs337JbYoTrnYRwoeO8AG+e8HvcSefiQ:ZaG0i
- TLSH
  T1DC64C7A0629D810AD2EEFB37E0718698F235B04AD3569FA9F6C7C06CA7D12717B451F0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  microsoft.dotnet.platformabstractions.dll
- Size 22KB
- SHA256 6ca2672efa324cd84f652f57d86e96ee92e91670d54770d8727d75620db2ea25
- MD5 663c6d7b691a9b1ab9ef2441724d4cee
- SHA1 7ec2bd3538fcbeca664d16841f45c0da73c774f6
- SHA512 4da401c4ccfea40efef9e54cad0341f25b303758ec8f569db3cbf6a1c66aad5057fe0a8df294c7423ef104977fae2eed7f9c540ff09777e7d668560aad200cdc
- SSDEEP 384:fes5vNExhxLynAU+s3LBUMox8fevZNW2LwWnHRN7vlmT7M:7SxhdynpYMMZtb
- TLSH
  T1E2A24B448BFC4526D6AF0A7462F5F5A66939B7830DA1DB0F044CA68D1D237C86B20B79
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  microsoft.extensions.dependencymodel.dll
- Size 57KB
- SHA256 86dfe88baf2d38841fd4e899d2f9d556c91465252a3ab31fdf7d93d39f9603e7
- MD5 6c24dae17ba34d1b9f9b908e6fa9d23f
- SHA1 12ac758c66188ea365511b62c555d0825847010b
- SHA512 7dcd6fdbb4b8f1bd59c57b4a0251be57b596ad604bfac20181c1d8666421c766e0c6ad7c61af05f2cd947b46c21a2443d0ed155dd1ddf6fee5ca6bc95b60a451
- SSDEEP 768:RYC38ZDZKGWr16ejmQiR9tDD8F1yfMWS6cMvlf/l5mY:JGZbixjmQiR9tDI+fgMvlffmY
- TLSH
  T1A1434B009BFC9306D9EE1E31A9B4A49507BBE6CA1863FF594E48A4B61E17FC01710B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  nativelibraryloader.dll
- Size 12KB
- SHA256 0885fe4f490f317f376b80dc429d709864f0d0688116d520db332020a48f0c6c
- MD5 0a35f614484817f5bb0d5ef859cb3873
- SHA1 722d68bb5792a30036dc1de4988f5fe6596f31ed
- SHA512 4befd616d7537a5915e3093eed49a8bdaf98f41b54818fe30b55c3ca2b42259219c47af2fc1fb2a207fd8ab4d112ace63baf3f2db8a811d4986deb3ac03bcce4
- SSDEEP 384:trwrZJYu6PsQ4zkB13333frMrB4MkjvWfWmRm5:trwrZJYFEQ4zk33YVts
- TLSH
  T16B42A708A7ED9326E9FE1B3A68B3038803B5FB766526DF1E45C4121E68637441261BB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  newtonsoft.json.dll
- Size 457KB
- SHA256 5d96ee51b2aff592039eebc2ed203d9f55fddf9c0882fb34d3f0e078374954a5
- MD5 04d49720df76d62bce434f19a0da62d2
- SHA1 53d0a3b91036092132f4d0887500b5dc77891d78
- SHA512 7727d077c518d4931b80286edb981af0e46d792cb9976de286cd2dbb4270157c5fae14766b2a39d49b44b41e5ec113de104dd2264edd1dc6799c9919b2f76d04
- SSDEEP 6144:WDGFyHTh/mZT9sNgyOj4ACNXfHDA36FuxMbPL9YjKecarCkHTaRypmV:9EQpsNgy/0jKeYyk
- TLSH
  T154A45B1023FCAB19E6EF1B39F4340A5897F1F856B67AE78D5840A8BA1CE3B514940773
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  sharpgen.runtime.com.dll
- Size 164KB
- SHA256 1bc25b36ae1260fe2df47ceca09b43d4d94e43a89768665daf1f22e7a7804913
- MD5 d0cbc3f2454f112e834c3d0e1c3cdf62
- SHA1 e3f51b2bab93c52c66689ff469dbfe02addae8fb
- SHA512 3ab288fe729414be657d0a049d7ae6c3e1297e375c93ff86517ef1b5c3ee0ad3d299856e35f3a5337337ba7cd32c66530fca9fd64b78c84b4915006c0e300e7a
- SSDEEP 3072:wi47j8v+xBiwBoRep5vHY6R114b0p2mIr/7QHzQaLd8sIb37O0oBSu:wi5+bx2R8vHpRtk7rkHzd8HWbk
- TLSH
  T187F37D23FA240757ED0E8AFF6D9291034EF192073612049E798166792EEFAC479367D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  sharpgen.runtime.dll
- Size 72KB
- SHA256 0735d8b666317c2f74355df7116b043706b631350c4f219ce3c5a913ed940009
- MD5 5452f8b57dbfc2456a584673b9a821d1
- SHA1 0524d20eb9dcdf1d7cdb8c32b5eb74b092fdc272
- SHA512 a80ddc2bf5392bdab384a24950bbc4ef6e295871f3d37899a1981fd5862fb340dc89e8cc86f32eca2dac1645e1e7455b837d4658a54417767a1430720675f8fc
- SSDEEP 1536:TpSFhcrPnNnnne9KWF7gXorzp8jjdfLvbOUP:dSz6PnNnnngdIorzpedfDlP
- TLSH
  T167735B2563DE4A56DBDC83BDB4B426248732E20B7563F35B6B84A4F5485334A8E123E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  sixlabors.imagesharp.dll
- Size 1.2MB
- SHA256 91c9c5706be3f7756e13be121185f163f0fea51e0f3c8b5a46fa7aebac1d26ec
- MD5 a9a60242eb5fed2e41e725398c06e2c3
- SHA1 53bff01120dd479d57158d89d9bb7267d7b25f03
- SHA512 8df9a33136861b93b9ea43069ef83c0e9e59412deafa224476a9b4d2dca86e8621834e22b774ed2379458e729af90aa33356c22ff0046460b2ed0ca0475ba0a3
- SSDEEP 12288:OT/zRFZMEqPtHf2NimJMq6Toz9omIF84mrmCxaKlKsDOCs5Z9cvie67E9eAbqQQF:2zRM86eo03lX74Tcvze6CZ9H0
- TLSH
  T1A8455B3673E89B2AC8DF6E36F2510807D3B2D0464697E7CB8580E6F12D533566E04ADB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  system.security.cryptography.protecteddata.dll
- Size 39KB
- SHA256 7ccc461b061d8e45acf41219809c8773028274037906180c77495571a305734b
- MD5 6c2dbb674f5f8ffcd6e9ab3fb7d04bf8
- SHA1 2af462280d60f54592a54ea927e9ed0bbe787869
- SHA512 b9c692586d12c5827d1afb39966059f85b33c0caf6fdace2ff3f14d6395175da5f907c3acf57321cb989395b8be744ebffac0090e32c5866ad05d50185254342
- SSDEEP 768:SaiNX3x7FVC7Yc1FeqBC2jWoDjw9zn8kZ:VirFE5nB/Wa4z5Z
- TLSH
  T1E7036C20B7A8D37AFD5F4975B871E405287C86869112BB3EC0C861841AE2FC66F317B7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  veldrid.dll
- Size 434KB
- SHA256 5b9b63763233b1f410809881edea713c4eff590bc3f45da37aae3923f48f9b98
- MD5 02fff7394ac2731eb98fa59f7abf3745
- SHA1 33193d52c11122e5a36d5d3cc0b628ef1fe84788
- SHA512 e888eba4fd14c4a900e1681d968415581fb64aac7f6ec24ead75c4e8f38b79f6f6c57ad1986aa88aab8240e78bf06c0fc4fc4214ec495210081dd33aba56139e
- SSDEEP 12288:0/q6tcAtsWrO+pW7Mn/1gfo+KuBxPYZqe1:v6ZrpW7M/QKuBxPYZqe1
- TLSH
  T108944AA52BFC9617F59FAB3BF071082A43F5F446A7AAF79E464096A91CC77408C10723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  veldrid.imagesharp.dll
- Size 15KB
- SHA256 a50f2d46a8da15738399c9462c7296db94980e7fe42927aab812277c0f31e684
- MD5 9a3df538b6e59526e43d0b7bbd579e48
- SHA1 0386f8e6b3eb15d1b42500a6a3f16ee78c2e7d6c
- SHA512 178768489a23cf8423c020a944bc93c7b14b6541d2991c4e31a525b551abcd4a9773b103ed1c084dde827a4be0bebae000e639608680f9e297e81b6a4a978468
- SSDEEP 384:Ys8uH6e2977MGVLtXApCGY+UX//F/NGDSBSv:ZH2977MmLtXAbYrNFjq
- TLSH
  T12662E529A39C8337FDAFDF31FC36A2900B78F7556462EB1F8A44948618077CD4861B26
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  veldrid.pdb
- Size 192KB
- SHA256 b393d5e62e6ff89a33c920a073b833b8d425a5e30299e91cd0651449163d071d
- MD5 940a00eb300dc8cab0c62c4c10edc610
- SHA1 18604cf902fbf9638a1e73af97ca22cbc41f7e26
- SHA512 867f838599b1f1aead3907d3618c77beae8ba0c4c80c11649d6d1d62ffbd6ec4074d3381d9e74b3268986fca2fcb827eccba4bbbdcd3beb0cc49a22297b77ce2
- SSDEEP 3072:xD/nJRfmL/0dTOHxgfKkD9Ds/RwfysuPAxXU4ogFUPl:xjlMHmfKKw/Rw6swaoPl
- TLSH
  T1C314291ADF44C21ECD0A157BC52786186BB1D148F94BCF17A2ECF3B29CA63840AD766D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral27 behavioral28
- Target
  veldrid.sdl2.dll
- Size 84KB
- SHA256 42e916403f43fbb24edc01113091029037c93a803498f9825cfe43d315245317
- MD5 2365a7a0f71f3825e4b103ec5161b5d2
- SHA1 eaae12dae242f3c610666ccc91ccb728abf46652
- SHA512 a5e1f430765da24056fabaabb950bede700969bafe67de59281106cc48af6df9a57f27b9ea1d3a992faea6ca6b8327189bba2b80401a8f7eecc9fa5b1060c6b6
- SSDEEP 1536:z2fnAuQ1BaRJkvznF5dvnimRx6o68pyvYqGH6GTSz/:KvAp1ywnF5dvnimNSz
- TLSH
  T1248319DB47F54A8CD5E8BF3CB61A21060331FD0A0D99D3AB281958E1FF937544AA86C7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  veldrid.startuputilities.dll
- Size 14KB
- SHA256 94bae2832e469212b8b52fc273cbf844d11939abca463b32ad73b9b17dff86ce
- MD5 3b4cd074fc7d6cb68e59a6b208fa9d75
- SHA1 b8488b06433e3f860b6dcbe1f8e172f6a6d6fc23
- SHA512 2dc5dd2c2b3c2cc89fac9d42caf9b8b1cde0e5c10b79d14fcb30c555f678c306b07cd9dee80d7280e6826ad468df3d7c7e7e3acce6fd5561a5a716ef7d9281a2
- SSDEEP 384:Lv+4iKB22EuBdSBmS9SN8tV2+0gMvDWY5:Lm4iKBfBkjTMvDW6
- TLSH
  T114523C14FFA40332DEFF4B376CB662008BF4FA095823CB1D1AC480995D9379989217A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Downloads MZ/PE file

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Checks installed software on the system

Contacts third-party web service commonly abused for C2

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32