MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 9

Intelligence 9 IOCs YARA 3 File information Comments

SHA256 hash:	1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216
SHA3-384 hash:	69723910ed2d1856979076a504ea17c0a586800b3d676308fdb0300cecd6d9a36ae6888457454dfcb74ecfb00c2a56df
SHA1 hash:	996b031230653a8c30a599294887104e7560c09a
MD5 hash:	c37aa1f15440984474370c9672432449
humanhash:	cola-eighteen-princess-quiet
File name:	Zoom.vbs
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	1'950 bytes
First seen:	2025-11-19 20:15:24 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	48:e6NETob0vknIPOCEjHyOz+BDzZOQgqWWAjUFP:DiobzIPgJNq1ES
Threatray	994 similar samples on MalwareBazaar
TLSH	T17941542FF901E3399E42C27391E65C3D9F91161A4400C0B4B6ED846CE728A35EBBA5D7
Magika	vba
Reporter	juroots
Tags:	ConnectWise vbs

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/38724/

Detection(s):

Sanesecurity.Malware.26618.JsHeur.UNOFFICIAL

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=691e259e40055a3d310dd148

Tags:

phishing dropper shell sage

Gathering data

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216

Verdict:

Malicious

File Type:

vbs

First seen:

2025-11-19T00:25:00Z UTC

Last seen:

2025-11-21T10:04:00Z UTC

Hits:

~100

Detections:

HEUR:Trojan.VBS.Agent.gen BSS:Trojan.Win32.Generic.nblk BSS:Trojan.Win32.Generic PDM:Trojan.Win32.Generic Trojan.Win32.Agent.sb not-a-virus:RemoteAdmin.MSIL.ConnectWise.d not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen not-a-virus:RemoteAdmin.MSIL.ConnectWise.c not-a-virus:RemoteAdmin.MSIL.ConnectWise.b not-a-virus:RemoteAdmin.MSIL.ConnectWise.a

Link:

https://opentip.kaspersky.com/1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216/results?tab=lookup

Score:

56%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216

Verdict:

Malware

YARA:

2 match(es)

Tags:

PowerShell Scripting.FileSystemObject Shell.Application VBScript WScript.Shell

Link:

https://app.malva.re/file/c37aa1f15440984474370c9672432449

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216/

Verdict:

Malicious

Threat:

RemoteAdmin.MSIL.ConnectWise

Link:

https://tip.neiki.dev/file/1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=dr5pfiqh7nc2prkgcps7pumf5iqk7ywtn7h7exyj4ildajpluila._file

Verdict:

suspicious

Label(s):

admintool_screenconnect

ConnectWise

3c46671af655e0a0b864208dd7a2ab5cd5a9d1f095c1b2fc0f7882d62ddae275

ConnectWise

64049e058f3414066b1b68f84306ec307670b4e93543888b6e40d8e18b74b718

ConnectWise

64adb568ceb1d4abb36113bde0ca9bffa423be366262f8a4ec75b1e23aef50ad

ConnectWise

a0c8f8770fffd941b3e123023432e275aea210a7ab71a6bce5be890861f054c2

ConnectWise

error

ConnectWise

f28a060cd841574451960ddc5f2a706526597e361b1a7eb86245488aaa431014

ConnectWise

+ 984 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

10/10

Tags:

backdoor discovery execution persistence privilege_escalation rat revoked_codesign

Link:

https://tria.ge/reports/251119-y113pafm9t/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Boot or Logon Autostart Execution: Authentication Package

Drops file in System32 directory

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Checks computer location settings

ConnectWise ScreenConnect remote access tool

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Binary is signed using a ConnectWise certificate revoked for key compromise.

Sets service image path in registry

Malware Config

Dropper Extraction:

https://server.skreenoutispanel.cc/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1c7af2a207fb45a7c54613e5f7d185ea20afe2d36fcff25f09e2163025eba216

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	Detect_Remcos_RAT Create hunting rule
Author:	daniyyell
Description:	Detects Remcos RAT payloads and commands

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)