🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 17


Intelligence 17 IOCs YARA 32 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e
SHA3-384 hash: 96c5239558dd2720c4d638259cf03fd13e2d5e910a66ddbaf7b76df2343585103643c5ada52d0829cce304a976160e20
SHA1 hash: aeb4cee7485371b540332cb4f7a474fb1cc9cb6e
MD5 hash: bfca6dfa55e14962f8d28dc4f13f987c
humanhash: don-robin-pasta-robin
File name:0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e.exe
Download: download sample
Signature ConnectWise
Create hunting rule
File size:12'828'216 bytes
First seen:2026-10-14 15:55:51 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 9771ee6344923fa220489ab01239bdfd (846 x ConnectWise)
ssdeep 98304:W3GF0s6efPzMn1Giy8E1PqhkG6ztZNK9aNGUMn1Giy8E1PqhAMn1Giy8E1PqhvMh:4GufefPyZWi6z3I96mZWijZWiuZWiN
TLSH T1DDD61211B3E691B5E0BF0638D87A62666631BC128751C7AF6794BE792D327C08E31373
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Tuxxin
Tags:ConnectWise exe signed

Code Signing Certificate

Organisation:ConnectWise, LLC
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2026-02-20T00:00:00Z
Valid to:2027-02-19T23:59:59Z
Serial number: 01dddbc6e9163d407d980a3eaf798528
Intelligence: 160 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: e1db8670d34a3d8099b9815c9772b37025a7b5d1845ec5256eb22dad7e196725
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
79
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
ScreenConnect
Details
Link:
https://research.acce.ciphertechsolutions.com/results/27810250-064e-43f5-8ae6-576ac5ecb45b/
Malware family:
connectwise
Create hunting rule
ID:
1
File name:
https://tundoctument.top/w/Sign/i.html
Verdict:
Malicious activity
Analysis date:
2026-10-13 16:08:53 UTC
Tags:
telegram ip-check screenconnect remote connectwise rmm-tool tool rat
Link:
https://app.any.run/tasks/d10533d5-6cb7-4fae-8d87-c1409a5adc40

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/91852/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad15f8e6f551121ba1661bf
Tags:
connectwise shellcode dropper crypted
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Launching a service
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug base64 corrupted evasive installer-heuristic microsoft_visual_cc net overlay packed packed privilege reconnaissance signed
Link:
https://www.filescan.io/uploads/6acfa61e5fe91cc0f6036226/reports/b9468a45-8671-40b5-9f5d-0806a23a1218/overview
Verdict:
Malicious
Labled as:
Win32_RemoteAdmin_ConnectWiseControl_Q_potentially_unsafe_application
Link:
https://www.hybrid-analysis.com/sample/0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e
Verdict:
Adware
File Type:
exe x32
First seen:
2026-10-14T12:59:00Z UTC
Last seen:
2026-10-16T04:06:00Z UTC
Hits:
~10
Detections:
BSS:Trojan.Win32.Generic BSS:Exploit.Win32.Generic.nblk BSS:Exploit.Win32.Generic not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen
Link:
https://opentip.kaspersky.com/0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e/results?tab=lookup
Malware family:
ConnectWise Inc
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/444a7fe7-54b6-4a9d-ac02-1bbe2b9e0d36
Result
Threat name:
ScreenConnect Tool
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
46 / 100
Link:
https://www.joesandbox.com/analysis/1987169
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Contains functionality to hide user accounts
Creates files in the system32 config directory
Enables network access during safeboot for specific services
Joe Sandbox ML detected suspicious sample
Modifies security policies related information
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1987169 Sample: 4U38IFNGkp.exe Startdate: 14/10/2026 Architecture: WINDOWS Score: 46 80 server-ovh30010049-relay.screenconnect.com 2->80 82 instance-onyqzo-relay.screenconnect.com 2->82 84 check.screenconnect.com 2->84 92 Multi AV Scanner detection for dropped file 2->92 94 Multi AV Scanner detection for submitted file 2->94 96 .NET source code contains potential unpacker 2->96 98 3 other signatures 2->98 8 msiexec.exe 95 48 2->8         started        12 4U38IFNGkp.exe 6 2->12         started        14 ScreenConnect.ClientService.exe 2->14         started        17 7 other processes 2->17 signatures3 process4 dnsIp5 64 C:\Windows\Installer\MSI1747.tmp, PE32 8->64 dropped 66 C:\Windows\Installer\MSI13DB.tmp, PE32 8->66 dropped 68 C:\...\ScreenConnect.WindowsFileManager.exe, PE32 8->68 dropped 72 10 other files (8 malicious) 8->72 dropped 104 Enables network access during safeboot for specific services 8->104 106 Modifies security policies related information 8->106 19 msiexec.exe 8->19         started        21 msiexec.exe 8->21         started        23 msiexec.exe 8->23         started        70 C:\Users\user\AppData\...\4U38IFNGkp.exe.log, ASCII 12->70 dropped 108 Contains functionality to hide user accounts 12->108 25 msiexec.exe 8 12->25         started        88 server-ovh30010049-relay.screenconnect.com 15.204.185.36, 443, 49715, 49717 OVHFR United States 14->88 28 ScreenConnect.WindowsClient.exe 14->28         started        31 ScreenConnect.WindowsClient.exe 14->31         started        90 127.0.0.1 unknown unknown 17->90 33 MpCmdRun.exe 17->33         started        file6 signatures7 process8 file9 35 rundll32.exe 15 13 19->35         started        40 rundll32.exe 12 19->40         started        42 rundll32.exe 11 19->42         started        74 C:\Users\user\AppData\Local\Temp\MSIC2B.tmp, PE32 25->74 dropped 76 C:\Users\user\AppData\Local\Temp\MSI62.tmp, PE32 25->76 dropped 78 C:\Users\user\AppData\Local\Temp\MSI4B8.tmp, PE32 25->78 dropped 110 Creates files in the system32 config directory 28->110 112 Contains functionality to hide user accounts 28->112 44 conhost.exe 33->44         started        signatures10 process11 dnsIp12 86 check.screenconnect.com 44.206.169.184, 443, 49707 AMAZON-AES-AmazoncomIncUS United States 35->86 58 8 other malicious files 35->58 dropped 100 System process connects to network (likely due to code injection or exploit) 35->100 102 Contains functionality to hide user accounts 35->102 46 C:\...\ScreenConnect.WindowsInstaller.dll, PE32 40->46 dropped 48 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 40->48 dropped 50 C:\...\ScreenConnect.InstallerActions.dll, PE32 40->50 dropped 60 5 other malicious files 40->60 dropped 52 C:\...\ScreenConnect.WindowsInstaller.dll, PE32 42->52 dropped 54 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 42->54 dropped 56 C:\...\ScreenConnect.InstallerActions.dll, PE32 42->56 dropped 62 5 other malicious files 42->62 dropped file13 signatures14
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net CAB:COMPRESSION:LZX CAB:COMPRESSION:NONE Executable Html Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.00 SOS: 0.07 SOS: 0.21 SOS: 0.24 SOS: 0.25 SOS: 0.27 SOS: 0.28 SOS: 0.31 SOS: 0.32 SOS: 0.36 SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/bfca6dfa55e14962f8d28dc4f13f987c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e/
Threat name:
Win32.Trojan.ScamSConnect
Create hunting rule
Status:
Malicious
First seen:
2026-10-08 03:47:04 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
10 of 24 (41.67%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=aermtghxzgo6kyx5vyt66sdmmzjvituj4fmwhnt5gqmp474sy47a._file
Verdict:
malicious
Label(s):
ADMINTOOL_ScreenConnect
Create hunting rule
Link:
https://reports.threatray.com/b4ebecb1-06b7-47f9-9757-2114b6aa5145
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor discovery persistence privilege_escalation ransomware rat
Link:
https://tria.ge/reports/261014-tdfe9axxbx/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Boot or Logon Autostart Execution: Authentication Package
Checks computer location settings
Drops file in System32 directory
Event Triggered Execution: Component Object Model Hijacking
Enumerates connected drives
ConnectWise ScreenConnect remote access tool
Badlisted process makes network request
Sets service image path in registry
Unpacked files
SH256 hash:
0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e
MD5 hash:
bfca6dfa55e14962f8d28dc4f13f987c
SHA1 hash:
aeb4cee7485371b540332cb4f7a474fb1cc9cb6e
Detections:
INDICATOR_EXE_DotNET_Encrypted
Create hunting rule
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
8a55c15cc76e31042e17458c479772aa95bc1b908016c85b1dc8b8e3eff23254
MD5 hash:
decb1fd20d75e6eade9289cc24605f29
SHA1 hash:
5169602d641c4f2ebd9ca0639622949e00c25566
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
2763b953657e3c4d6b2f952218a1e1963bcd6971f0b1102d99bb7efea04ceb29
MD5 hash:
ac23969c4bb28b9faa93f4e794f02cb4
SHA1 hash:
71481bc198a840642511a9ab6e686953c623ed25
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
27e873d0fceefdd1a12ca77e3bbecec2ece7acdba433b47dca102c35e1c5896c
MD5 hash:
495ae918d089b4846bd4a50bdc06b0b7
SHA1 hash:
d8457f6d5f37198a1d3aaddf286cb1c5293c9e9c
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
2ae8aa570f062c78de8df5ab7a2b4610d3a6767c956a07c27924a20424f5daec
MD5 hash:
879bd9493293d0b91179075e687fcf9d
SHA1 hash:
604f8743ea16ce28d70299b46957e5a21fcea5bb
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
78fa9cf69577f6990275c7c472f7114f9d0c85e660f3b9c81b085fc3cfbc8673
MD5 hash:
20b930dc08fde485186d7687a48779ab
SHA1 hash:
0142109ebe6b95d9704f0954c232fc8ad2f25630
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
Parent samples :
2b619dc0b6f585f22c37d32e53d72871ad473b50d24e16f8578504886a0c3675
c51313f8ba25595e6f0619958bdb03b5a6ae0f7c5bc13b2704160a0804447131
57cf81533546785a6340b393330eb5cad02d8a27a95241f6940a702a42e3b4fd
20ff9802f133c7c75431ca0850240c99dc573c3ccfb6c57cec01696826af564a
b8884c8899f6ac4f8999c0736d04a856d3e7d9d57c775513078bd63b4bfd2d3f
6fb97a2c7104a0da95241868e4bf190162f91d444c070520555e52accde27c9f
0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e
1a58509437997e827b686f88abd70ceb6b73b9e2573b70dbc1017ec050b65df6
14353f0d049fbf88896168dd13e106857179ce9fc1909aaad698b78492a07fc4
SH256 hash:
d8a6ef30d0aec9060032fd528777cf396a5ae7d41481f13f3b19797c1bf1d1c2
MD5 hash:
1d6f75631d8c27ab8fbf54917d523681
SHA1 hash:
a1ffea609d20ee57d58cef8c45991a390d74d874
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
289a4eea79baa4141744e44d60db713e18b5f23322663c63047962f51b467614
MD5 hash:
48979a1a6d3badea8124bce04b1e01a5
SHA1 hash:
06931bd96343ce167eda796112a30ca8d9fa536a
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
b7cc95b944283af6d1e0c466fe48560c403a931c4e5ebc3b8fd10dce848eb2ac
MD5 hash:
8aa1899f6e21961d27fae472dbe2e4a2
SHA1 hash:
343db3345e38c2d20c453deeb28f6453b2c71688
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
361bbc692084841e4c8d22c89ca89c711d0fe17bc8759241736531a2f28de25b
MD5 hash:
72899e40e3d32282fd63c34b87b9385c
SHA1 hash:
5ad8f5020613acfaa84259809c373cc144af9076
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
93f910f732855000861c1b4e6c55a2dee0a8cbb2172d89c7a2bc99053746c193
MD5 hash:
9edc01ae0bafe0a1c610d9c8014ad563
SHA1 hash:
5fbf0ba61aaaae5b506d78ca862286a676a61fbf
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
SUSP_NET_Shellcode_Loader_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
Parent samples :
2b619dc0b6f585f22c37d32e53d72871ad473b50d24e16f8578504886a0c3675
c51313f8ba25595e6f0619958bdb03b5a6ae0f7c5bc13b2704160a0804447131
57cf81533546785a6340b393330eb5cad02d8a27a95241f6940a702a42e3b4fd
474187ebbc6b0dce7ea694222581f40e23971023158fb74e8404e04180254e11
20ff9802f133c7c75431ca0850240c99dc573c3ccfb6c57cec01696826af564a
b8884c8899f6ac4f8999c0736d04a856d3e7d9d57c775513078bd63b4bfd2d3f
6fb97a2c7104a0da95241868e4bf190162f91d444c070520555e52accde27c9f
0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e
1a58509437997e827b686f88abd70ceb6b73b9e2573b70dbc1017ec050b65df6
14353f0d049fbf88896168dd13e106857179ce9fc1909aaad698b78492a07fc4
SH256 hash:
19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc
MD5 hash:
5fb6074b08ac4709cf2f29fa5b49023e
SHA1 hash:
8bbb78a47c08867c50572f0bd2a27171f91e0454
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
ad6062215032ab58369403b1221562b5e7fb5ae7d52b29b7fad69eefb2d8455b
MD5 hash:
723f2aaeeda1d2bb2f49322da349ffc9
SHA1 hash:
ac6ab994beaff69adf8a2dc480a8a628175ff6c8
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
db93544f2865c1745edeb90f08507bc73ea42e0dd42cd61e5add767d83b65f5a
MD5 hash:
91608e19a788624d420fe0904647f366
SHA1 hash:
cb875cb475393c35ee4483075d8bb0419f832e00
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
9342c7be8036a5f8dc3895d75e3314dce961fd3bc70ee59928c67fa04f0c7e08
MD5 hash:
5419ff27205d3e5affa3fc18b811b843
SHA1 hash:
cf49072c50456381cd26cd32cb97606c5f5cfd26
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
SH256 hash:
74f2d225b492eb77a5654bcaafec5162d0c5f72de884daa4c32daf54e2bff3d7
MD5 hash:
b759084c5614aacb33fec8faccd0c5ad
SHA1 hash:
d9a6c9802092d9ec4e7e9eb0872127d74db4bfd4
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
Parent samples :
2b619dc0b6f585f22c37d32e53d72871ad473b50d24e16f8578504886a0c3675
c51313f8ba25595e6f0619958bdb03b5a6ae0f7c5bc13b2704160a0804447131
57cf81533546785a6340b393330eb5cad02d8a27a95241f6940a702a42e3b4fd
474187ebbc6b0dce7ea694222581f40e23971023158fb74e8404e04180254e11
20ff9802f133c7c75431ca0850240c99dc573c3ccfb6c57cec01696826af564a
b8884c8899f6ac4f8999c0736d04a856d3e7d9d57c775513078bd63b4bfd2d3f
6fb97a2c7104a0da95241868e4bf190162f91d444c070520555e52accde27c9f
0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e
1a58509437997e827b686f88abd70ceb6b73b9e2573b70dbc1017ec050b65df6
14353f0d049fbf88896168dd13e106857179ce9fc1909aaad698b78492a07fc4
SH256 hash:
b72369fe46d5eb6646d138302f323ccc2d83a88ee42c4070050a1f755b29e486
MD5 hash:
d31ee12814f14509040263fc7f446932
SHA1 hash:
e832cf9f5f333ee04b8a10a4f68b8219c4fdf932
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/a6a55bf8-e320-40c0-acf7-d2d409e81700/
Parent samples :
2b619dc0b6f585f22c37d32e53d72871ad473b50d24e16f8578504886a0c3675
c51313f8ba25595e6f0619958bdb03b5a6ae0f7c5bc13b2704160a0804447131
57cf81533546785a6340b393330eb5cad02d8a27a95241f6940a702a42e3b4fd
474187ebbc6b0dce7ea694222581f40e23971023158fb74e8404e04180254e11
20ff9802f133c7c75431ca0850240c99dc573c3ccfb6c57cec01696826af564a
b8884c8899f6ac4f8999c0736d04a856d3e7d9d57c775513078bd63b4bfd2d3f
6fb97a2c7104a0da95241868e4bf190162f91d444c070520555e52accde27c9f
0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e
1a58509437997e827b686f88abd70ceb6b73b9e2573b70dbc1017ec050b65df6
14353f0d049fbf88896168dd13e106857179ce9fc1909aaad698b78492a07fc4
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_DotNET_Encrypted
Create hunting rule
Author:ditekSHen
Description:Detects encrypted or obfuscated .NET executables
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
Rule name:Malware_PE_NET_KoiLoader
Create hunting rule
Author:Serhii Kocherhan
Description:Detects Koi Loader .NET executables packed with Confuser featuring specific mutex, assembly metadata, and unmanaged DLL imports
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TigerRAT_pe_yaraify
Create hunting rule
Author:hunts-yara-code
Description:YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
Rule name:WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects ACRStealer (pe, etat extrait)
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_43faefd2
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_7e8e91c4
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_92a28498
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_e596237b_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f1079127
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ConnectWise

Executable exe 0122c998f7c99de562fdae27ef486c6653544e89e15963b67d3418fe7f92c73e

(this sample)

  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/3950140/
Cape
Cape
https://www.capesandbox.com/analysis/91852/

Comments