🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 11


Intelligence 11 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715
SHA3-384 hash: 2038db40095c6dc438375790e057f9d38fd8b47e3d91749ebb56120d24fa1c3c1668399b719006d9b6f42270eae026ce
SHA1 hash: be9e5115a8d1dba09a90c7dabd7f4eb9776a069b
MD5 hash: d60faab06fd2a96468f60d9d03ddede2
humanhash: july-crazy-virginia-tennessee
File name:ScreenConnect.ClientSetup.exe
Download: download sample
Signature ConnectWise
Create hunting rule
File size:9'615'851 bytes
First seen:2026-08-11 08:25:48 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9771ee6344923fa220489ab01239bdfd (763 x ConnectWise)
ssdeep 196608:GfefPKeq5KqDBCDkSt7QEUeq5KqDBCDkSt3eq5KqDi:rq5VDBCDx7QEZq5VDBCDxOq5VDi
TLSH T141A61211B3D291B6D4BF0638C87A53656B74BC008766C7BB6394BD692D32BC08E32767
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter abuse_ch
Tags:ConnectWise exe rmm screenconnect

Intelligence

File Origin
# of uploads :
1
# of downloads :
142
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
ScreenConnect
Details
Link:
https://research.acce.ciphertechsolutions.com/results/4e037fcb-6180-41d1-82a7-ebdc9bd4a208/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/80253/
Result
Verdict:
Malware
Maliciousness:
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
anti-debug base64 corrupted evasive installer-heuristic microsoft_visual_cc overlay packed packed privilege reconnaissance
Link:
https://www.filescan.io/uploads/6a7adcb0ac690aab811366d7/reports/00bbfeb4-e413-4ba4-812a-97bd6f791ccf/overview
Verdict:
Malicious
Labled as:
HackTool/ConnectWiseControl.i
Link:
https://www.hybrid-analysis.com/sample/302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715
Verdict:
Adware
File Type:
exe x32
First seen:
2026-08-10T20:09:00Z UTC
Last seen:
2026-08-12T19:53:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715/results?tab=lookup
Malware family:
ConnectWise Inc
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/ef0acdbe-4dd5-4a08-995e-1ea9e54eeb93
Result
Threat name:
ScreenConnect Tool
Create hunting rule
Detection:
malicious
Classification:
n/a
Score:
52 / 100
Link:
https://www.joesandbox.com/analysis/1955750
Signature
Contains functionality to hide user accounts
Multi AV Scanner detection for submitted file
Behaviour
Behavior Graph:
Download SVG
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net CAB:COMPRESSION:LZX CAB:COMPRESSION:NONE Executable Html Managed .NET PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) SOS: 0.21 SOS: 0.24 SOS: 0.25 SOS: 0.27 SOS: 0.28 SOS: 0.31 SOS: 0.36 SOS: 0.39
Link:
https://app.malva.re/file/d60faab06fd2a96468f60d9d03ddede2
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=gaxuwhgpdaepuv75gd2orytshmud7sfb2t5imjt5puirqow2e4kq._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/260811-kb3y4azalf/
Unpacked files
SH256 hash:
302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715
MD5 hash:
d60faab06fd2a96468f60d9d03ddede2
SHA1 hash:
be9e5115a8d1dba09a90c7dabd7f4eb9776a069b
Detections:
triage_screenconnect_rat
Create hunting rule
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
9342c7be8036a5f8dc3895d75e3314dce961fd3bc70ee59928c67fa04f0c7e08
MD5 hash:
5419ff27205d3e5affa3fc18b811b843
SHA1 hash:
cf49072c50456381cd26cd32cb97606c5f5cfd26
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
8a55c15cc76e31042e17458c479772aa95bc1b908016c85b1dc8b8e3eff23254
MD5 hash:
decb1fd20d75e6eade9289cc24605f29
SHA1 hash:
5169602d641c4f2ebd9ca0639622949e00c25566
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
ad6062215032ab58369403b1221562b5e7fb5ae7d52b29b7fad69eefb2d8455b
MD5 hash:
723f2aaeeda1d2bb2f49322da349ffc9
SHA1 hash:
ac6ab994beaff69adf8a2dc480a8a628175ff6c8
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
289a4eea79baa4141744e44d60db713e18b5f23322663c63047962f51b467614
MD5 hash:
48979a1a6d3badea8124bce04b1e01a5
SHA1 hash:
06931bd96343ce167eda796112a30ca8d9fa536a
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
MD5 hash:
9a608a8c0652b8ef1be1ca636e1d1238
SHA1 hash:
08a05849a0e93ad8bc47f34d326d0e4b11bb4306
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
e2dbaea60c2d41852c6f7592e20395f5f74410b7e2cf4699a59bbbc74d21ff9c
MD5 hash:
c1e8761a271c28c8ff7ec2ad7da28b72
SHA1 hash:
60cd1db0eada77e2dcbe13a99d2db39be1001f7b
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc
MD5 hash:
5fb6074b08ac4709cf2f29fa5b49023e
SHA1 hash:
8bbb78a47c08867c50572f0bd2a27171f91e0454
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
5823b2e2d6771e59b3582d7da155c5b0d630382fb059de00585be0b76b0edd64
MD5 hash:
00be0730ba27cce06c9098c41289ed57
SHA1 hash:
2f90d5a5eaf8f53520de34e3bc3626f672381970
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
6e7870e2bdcf8db1ace8ba6e014f628ed274ce21d7042e470585c3fc8acb376f
MD5 hash:
d7ada7fe1fbeefd95f61c2319e230f68
SHA1 hash:
4435062964561e6337e0154c7edafe6351eeda54
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
MD5 hash:
9ce87a0b14a55ab8ad17602ea10f8cd9
SHA1 hash:
e0674df443bf5aaeb91557629c45d921576cda68
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
SH256 hash:
15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
MD5 hash:
bbfa13f0a1213839b8538d7bf5b59729
SHA1 hash:
58149ef3d2d898b71fe418ab578f81601b0aa860
Link:
https://www.unpac.me/results/5be5e034-0b40-4969-85d8-6534263ba22d/
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_DotNET_Encrypted
Create hunting rule
Author:ditekSHen
Description:Detects encrypted or obfuscated .NET executables
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ConnectWise

Executable exe 302f4b1ccf1808fa57fd30f4e8e2723b283fc8a1d4fa86267d7d11183ada2715

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/3899755/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/80253/

Comments