MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2113ea4c4a65b7e575163cf247c01f5c088fa3f2cdad72b2584f71b31e668b62. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 6

Intelligence 6 IOCs YARA 11 File information Comments

SHA256 hash:	2113ea4c4a65b7e575163cf247c01f5c088fa3f2cdad72b2584f71b31e668b62
SHA3-384 hash:	598d4299b64bd6073e929d168bc35a4686c127fa626c2d066db0e0543c670f305488258e1ca664e2f4e854e99c28a6f2
SHA1 hash:	fb30bb1a3a15dcc213777582cb21acc1531b6d2f
MD5 hash:	ad679a5b9f60eb7df74905f0b94697de
humanhash:	utah-jersey-lamp-fillet
File name:	Stake Predictor V 7.2.zip
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	12'977'338 bytes
First seen:	2025-02-16 13:23:12 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:F8m/jKLxem2yqLaePR5gdb3cJ7kgWXedoCrJCkyexgpI+nzcks:C5xqHFqFcCXiougbecFxs
TLSH	T1FDD633BA134939C4797E4DC4DA716CAE8F21C36B22A12B27362D940ED5B3EB471D311B
Magika	zip
Reporter	aachum
Tags:	ConnectWise zip

iamaachum

https://sourceforge.net/projects/stake-predictor/files/latest/download

ConnectWise ScreenConnect C2: web.winserve.ru

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

File Archive Information

This file archive contains 3 file(s), sorted by their relevance:

File name:	Installer.data
File size:	8'704 bytes
SHA256 hash:	7c8f2a2ffbe4da5c85f2c764b988feceaed2b7fb21049196e8c014fdf9ee934c
MD5 hash:	1e1a03c1926def157aba3d0c5c116604
MIME type:	application/x-dosexec
Signature	ConnectWise

File name:	Stake Predictor.exe
File size:	279'040 bytes
SHA256 hash:	e7c7a7f0cb57e2c35d967664aa8dd464d2f844e7a8c906f7ce04a336fb68940c
MD5 hash:	9ca9a66844c8c10b5b1d6909cb864a93
MIME type:	application/x-dosexec
Signature	ConnectWise

File name:	x64.dll
File size:	13'361'152 bytes
SHA256 hash:	6dce989db719c53882bfcb37a5293c6967974dd4dced275bfda4627f2624d9f7
MD5 hash:	25195faa4dc3735a0fa401e2d393d3be
MIME type:	application/x-msi
Signature	ConnectWise

Vendor Threat Intelligence

Verdict:

Suspicious

Score:

50%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67b1e79628ab76d43a5b37ad

Tags:

phishing

Result

Verdict:

Unknown

File Type:

PE File

Link:

https://app.docguard.net/2113ea4c4a65b7e575163cf247c01f5c088fa3f2cdad72b2584f71b31e668b62/results/dashboard

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

lolbin msiexec obfuscated obfuscated

Link:

https://www.filescan.io/uploads/67b1e6d0991985e0a959d500/reports/80947293-fe0b-418e-9d76-b28e863d37d2/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2113ea4c4a65b7e575163cf247c01f5c088fa3f2cdad72b2584f71b31e668b62

Result

Verdict:

SUSPICIOUS

Link:

https://labs.inquest.net/dfi/sha256/2113ea4c4a65b7e575163cf247c01f5c088fa3f2cdad72b2584f71b31e668b62

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Score:

72%

Verdict:

Malware

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery persistence privilege_escalation

Link:

https://tria.ge/reports/250216-q76bzsyrbn/

Behaviour

System Location Discovery: System Language Discovery

System Network Configuration Discovery: Internet Connection Discovery

Downloads MZ/PE file

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/2113ea4c4a65b7e575163cf247c01f5c088fa3f2cdad72b2584f71b31e668b62

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	INDICATOR_RMM_ConnectWise_ScreenConnect Create hunting rule
Author:	ditekSHen
Description:	Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	pe_no_import_table Create hunting rule
Description:	Detect pe file that no import table

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_Obf_Enc_Spoof_Hide_PE Create hunting rule
Author:	XiAnzheng
Description:	Check for Overlay, Obfuscating, Encrypting, Spoofing, Hiding, or Entropy Technique(can create FP)