MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 1dff513d05c2d51b18ad7f4fda789347760fc84e02cb88edb5d974f32589cf40. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 6

Intelligence 6 IOCs YARA 22 File information Comments

SHA256 hash:	1dff513d05c2d51b18ad7f4fda789347760fc84e02cb88edb5d974f32589cf40
SHA3-384 hash:	c6b41ca6cb3952bf10155b9d15a13a78cbc3e1e2e12677502399282e466cf9c3fcf0be738d327fa4984c37b22a9ae073
SHA1 hash:	51e14b861774dbc1a51929f35e6a7e4ec8f68de7
MD5 hash:	f1748f38f9910cf6e6b3a319515204e6
humanhash:	may-whiskey-georgia-six
File name:	scptoolkit-1-6-238-16010.zip
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	43'568'745 bytes
First seen:	2025-04-01 00:18:24 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	786432:BIOgKpQdosHkSMAX2u4CDGH4YBjZoxA5Y3JruiKp5bcp7E/vXbphBPk:aOg+9AXeCDs4YBjZoC5AJruiSuOHre
TLSH	T1E5A73317E00C01758A96A07FD3AFAA98537EC86A25064072EF0C7F9D4727757A1FEB48
Magika	zip
Reporter	aachum
Tags:	ConnectWise jmutanen software Oy zip

iamaachum

https://sourceforge.net/projects/scptoolkit/

ScreenConnect C2: microsoftnet.ru

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 4 file(s), sorted by their relevance:

File name:	VC_redist.x64.exe
File size:	13'949'616 bytes
SHA256 hash:	c4e3992f3883005881cf3937f9e33f1c7d792ac1c860ea9c52d8f120a16a7eb1
MD5 hash:	3ca2b599c42442b57aeb07229d731d71
MIME type:	application/x-dosexec
Signature	ConnectWise

File name:	VC_redist.x86.msi
File size:	9'924'608 bytes
SHA256 hash:	b5aca84d6ed69712edbf572db54cfdfd4375f5f89326e5fcecbe2adf9b9fee68
MD5 hash:	a2262594095967220b064086164c7ad3
MIME type:	application/x-msi
Signature	ConnectWise

File name:	scptoolkit.data
File size:	23'361'996 bytes
SHA256 hash:	748fe39665091cc9e47d6535dd2c18d5062e80d23715a100fb6b97d7a24686cb
MD5 hash:	f9b4b42870d9291ad55d03590fb411de
MIME type:	application/x-dosexec
Signature	ConnectWise

File name:	scptoolkit-1-6-238-16010.exe
File size:	158'264 bytes
SHA256 hash:	a8cbffeb05c4d8f9f6d8a091b393c9dfdcd34305bc218588911f98f335116eda
MD5 hash:	23bd5ec4d7abb9c06c4c5f35edd58deb
MIME type:	application/x-dosexec
Signature	ConnectWise

Vendor Threat Intelligence

Verdict:

Malicious

Score:

94.1%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67eb27b2855e5ec5240b160d

Tags:

shellcode dropper remo

Verdict:

Unknown

Threat level:

2.5/10

Confidence:

100%

Tags:

lolbin msiexec obfuscated signed

Link:

https://www.filescan.io/uploads/67eb30fb60f41dea7eaa8de1/reports/bfe7f0de-14a2-4594-aa85-444f45c22713/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/1dff513d05c2d51b18ad7f4fda789347760fc84e02cb88edb5d974f32589cf40

Result

Verdict:

UNKNOWN

Link:

https://labs.inquest.net/dfi/sha256/1dff513d05c2d51b18ad7f4fda789347760fc84e02cb88edb5d974f32589cf40

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

40%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250401-fxndbawny8/

Behaviour

Suspicious use of WriteProcessMemory

System Location Discovery: System Language Discovery

Checks installed software on the system

Executes dropped EXE

Loads dropped DLL

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/1dff513d05c2d51b18ad7f4fda789347760fc84e02cb88edb5d974f32589cf40

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	detect_powershell Create hunting rule
Author:	daniyyell
Description:	Detects suspicious PowerShell activity related to malware execution

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_RMM_ConnectWise_ScreenConnect Create hunting rule
Author:	ditekSHen
Description:	Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	pe_imphash Create hunting rule

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)