MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 7

Intelligence 7 IOCs YARA 2 File information Comments

SHA256 hash:	319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
SHA3-384 hash:	b0bc0e655243c3eef10b684572c79a6dfb592680af39311a6757c0bb84e681b0f6061bd8c2985cd53a5b920c3d10d9cd
SHA1 hash:	27d351219ad62fc914c6c34eed8373fee6de294d
MD5 hash:	5d4be679ad5c4bfb5144f381d3308ab3
humanhash:	friend-november-spaghetti-zebra
File name:	319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281.exe
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	68'096 bytes
First seen:	2026-08-25 10:35:34 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 62 x CobaltStrike, 44 x JanelaRAT)
ssdeep	768:c3gaRdcdsmzKWOWXlhh6Eg/6QhvoTVcV7K0c4RelfyQFVFlCtskxZgVfS8EX8bED:tCsKWOGmEgLhvoTVF0JJQFVFlPasbg
TLSH	T1B0633B06E3F98A7BC9DF5F7878B5B0450EB08A02E062FB989CC9A5D71B537C119053A7
TrID	25.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 25.3% (.EXE) Win64 Executable (generic) (6522/11/2) 17.5% (.EXE) Win32 Executable (generic) (4504/4/1) 8.0% (.ICL) Windows Icons Library (generic) (2059/9) 7.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Tuxxin
Tags:	ConnectWise dll exe whack.sh

Intelligence

File Origin

# of uploads :

# of downloads :

173

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/82703/

Verdict:

Clean

Score:

89.3%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac690768d296b0bc3074042

Tags:

n/a

Result

Verdict:

Clean

Maliciousness:

Verdict:

Suspicious

Threat level:

5/10

Confidence:

100%

Tags:

base64 masquerade

Link:

https://www.filescan.io/uploads/6a8d701efcdffd8578d9cfc3/reports/fe964a06-16ab-44e2-bacd-c68d9202bde8/overview

Verdict:

Suspicious

Labled as:

Notavirus_HEUR_RemoteAdmin_MSIL_ConnectWise_gen

Link:

https://www.hybrid-analysis.com/sample/319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281

Verdict:

Adware

File Type:

executable.pe.32.dll

First seen:

2025-04-15T04:01:00Z UTC

Last seen:

2026-08-27T08:34:00Z UTC

Hits:

~100000

Link:

https://opentip.kaspersky.com/319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281/results?tab=lookup

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/631b4b7c-48dd-4671-ae4c-49b5884518f5

Score:

Verdict:

Benign

File Type:

Link:

https://malprob.io/report/319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281

Verdict:

inconclusive

YARA:

6 match(es)

Tags:

.Net Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.27 Win 32 Exe x86

Link:

https://app.malva.re/file/5d4be679ad5c4bfb5144f381d3308ab3

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281/

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ggn2eqiv4zhkjnyuzl2ordj5ljsy336vdvyuyiurxf2yizuskkaq._file

Result

Malware family:

n/a

Score:

3/10

Tags:

n/a

Link:

https://tria.ge/reports/260825-mnb29aw1f1/

Unpacked files

SH256 hash:

319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281

MD5 hash:

5d4be679ad5c4bfb5144f381d3308ab3

SHA1 hash:

27d351219ad62fc914c6c34eed8373fee6de294d

Detections:

SUSP_NET_Large_Static_Array_In_Small_File_Jan24

Link:

https://www.unpac.me/results/40533649-eff9-411d-ac18-576af63fccbf/

Parent samples :

319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281
7d5ec667fbdaeb0137de26048c2b1cfce32cf939b6a94639d6d292903085faec

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.56

Link:

https://yomi.yoroi.company/submissions/319ba24115e64ea4b714caf4e88d3d5a658defd51d714c2291b9758466925281

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	extracted_at_0x44b Create hunting rule
Author:	cb
Description:	sample - file extracted_at_0x44b.exe
Reference:	Internal Research

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.