BypAI.zip
- SHA256 2b4e3692a542d1bad5cd2386caac14c32f177793dbe5c046c1b446a0b179b100
Overview
overview
8Static
static
4BypAI/BypA...nt.exe
windows10-2004-x64
1BypAI/BypA...nt.exe
windows11-ltsc_2024-x64
8costura.dll
windows10-2004-x64
1costura.dll
windows11-ltsc_2024-x64
1imgui.net.dll
windows10-2004-x64
1imgui.net.dll
windows11-ltsc_2024-x64
1microsoft....ns.dll
windows10-2004-x64
1microsoft....ns.dll
windows11-ltsc_2024-x64
1microsoft....el.dll
windows10-2004-x64
1microsoft....el.dll
windows11-ltsc_2024-x64
1nativelibr...er.dll
windows10-2004-x64
1nativelibr...er.dll
windows11-ltsc_2024-x64
1newtonsoft.json.dll
windows10-2004-x64
1newtonsoft.json.dll
windows11-ltsc_2024-x64
1sharpgen.r...om.dll
windows10-2004-x64
1sharpgen.r...om.dll
windows11-ltsc_2024-x64
1sharpgen.runtime.dll
windows10-2004-x64
1sharpgen.runtime.dll
windows11-ltsc_2024-x64
1sixlabors....rp.dll
windows10-2004-x64
1sixlabors....rp.dll
windows11-ltsc_2024-x64
1system.sec...ta.dll
windows10-2004-x64
1system.sec...ta.dll
windows11-ltsc_2024-x64
1veldrid.dll
windows10-2004-x64
1veldrid.dll
windows11-ltsc_2024-x64
1veldrid.im...rp.dll
windows10-2004-x64
1veldrid.im...rp.dll
windows11-ltsc_2024-x64
1veldrid.pdb
windows10-2004-x64
3veldrid.pdb
windows11-ltsc_2024-x64
3veldrid.sdl2.dll
windows10-2004-x64
1veldrid.sdl2.dll
windows11-ltsc_2024-x64
1veldrid.st...es.dll
windows10-2004-x64
1veldrid.st...es.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
BypAI/BypAI-Client.exe
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
BypAI/BypAI-Client.exe
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
costura.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
costura.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
imgui.net.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
imgui.net.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
microsoft.dotnet.platformabstractions.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
microsoft.dotnet.platformabstractions.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
microsoft.extensions.dependencymodel.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
microsoft.extensions.dependencymodel.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
nativelibraryloader.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
nativelibraryloader.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
newtonsoft.json.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
newtonsoft.json.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
sharpgen.runtime.com.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
sharpgen.runtime.com.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
sharpgen.runtime.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
sharpgen.runtime.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral19
Sample
sixlabors.imagesharp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
sixlabors.imagesharp.dll
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral21
Sample
system.security.cryptography.protecteddata.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
system.security.cryptography.protecteddata.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
veldrid.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
veldrid.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
veldrid.imagesharp.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
veldrid.imagesharp.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
veldrid.pdb
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
veldrid.pdb
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral29
Sample
veldrid.sdl2.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral30
Sample
veldrid.sdl2.dll
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral31
Sample
veldrid.startuputilities.dll
Resource
win10v2004-20260513-en
Behavioral task
behavioral32
Sample
veldrid.startuputilities.dll
Resource
win11ltsc2024-20260709-en
Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.
| resource | yara_rule |
|---|---|
| static1/unpack001/BypAI/BypAI-Client.dll | costura |
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/BypAI/BypAI-Client.dll |
| unpack002/costura.dll |
| unpack002/imgui.net.dll |
| unpack002/nativelibraryloader.dll |
| unpack002/newtonsoft.json.dll |
| unpack002/sharpgen.runtime.com.dll |
| unpack002/sharpgen.runtime.dll |
| unpack002/sixlabors.imagesharp.dll |
| unpack002/veldrid.dll |
| unpack002/veldrid.imagesharp.dll |
| unpack002/veldrid.metalbindings.dll |
| unpack002/veldrid.openglbindings.dll |
| unpack002/veldrid.sdl2.dll |
| unpack002/veldrid.startuputilities.dll |
| unpack002/vk.dll |
| unpack002/vortice.d3dcompiler.dll |
| unpack002/vortice.direct3d11.dll |
| unpack002/vortice.directx.dll |
| unpack002/vortice.dxgi.dll |
| unpack002/vortice.mathematics.dll |
| unpack001/BypAI/BypAI-Client.exe |
| unpack001/BypAI/runtimes/win-x64/native/SDL2.dll |
| unpack001/BypAI/runtimes/win-x64/native/cimgui.dll |
| unpack001/BypAI/runtimes/win-x86/native/SDL2.dll |
| unpack001/BypAI/runtimes/win-x86/native/cimgui.dll |
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Oct 16, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Oct 16, 2017
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Oct 24, 2025
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=10, id=259, version=35207,
count=13, id=260, version=35207,
count=86, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=212, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=23, id=259, version=28900,
count=160, id=261, version=28900,
count=19, id=260, version=28900,
count=10, id=259, version=34321,
count=15, id=260, version=34321,
count=38, id=261, version=34321,
count=9, id=257, version=28900,
count=107, id=1, productName=Unmarked objects,
count=6, id=261, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=34, id=259, version=28900,
count=163, id=261, version=28900,
count=26, id=260, version=28900,
count=23, id=259, version=34321,
count=16, id=260, version=34321,
count=35, id=261, version=34321,
count=9, id=257, version=28900,
count=99, id=1, productName=Unmarked objects,
count=6, id=261, version=34435,
count=1, id=256, version=34435,
count=1, id=255, version=34435,
count=1, id=258, version=34435,