MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 44072cefed23cb8d6ea255e2b62918c35249f6d760c41faf5da6714c35319c3e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 13

Intelligence 13 IOCs YARA 7 File information Comments

SHA256 hash:	44072cefed23cb8d6ea255e2b62918c35249f6d760c41faf5da6714c35319c3e
SHA3-384 hash:	f4a69ed72a873969a0892d66c2d3e29c9de2945e39bf89b05b7dc9ddd91ff130478b79b89f548578b25df35feb53df79
SHA1 hash:	7ebd4086c2ff7b58077d5f7ce251b145e833ad07
MD5 hash:	3701602b85dec6e6e5c4a95ad8a2d07d
humanhash:	arizona-enemy-cup-hydrogen
File name:	44072cefed23cb8d6ea255e2b62918c35249f6d760c41faf5da6714c35319c3e.msi
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	14'385'152 bytes
First seen:	2026-11-15 00:31:42 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	196608:dHxcp9ym3nltDUJVzHxcp9ym3EHxcp9ym3VHxcp9ym3tHxcp9ym3ZHxcp9ym3sH1:PGplpIGpiGpHGpfGprGpKGp6
TLSH	T1F1E6231567FC8669F0B22A30B53655B19AB53C959C72E23F3124BE4E1972F4888F2733
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	Tuxxin
Tags:	ConnectWise msi

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

MSI

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7cea6982-b770-40e9-96ea-b88fbfadad46/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/100087/

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6af8fd97fc945c1ebf2a2d9a

Tags:

connectwise shellcode dropper micro

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Creating synchronization primitives

Searching for synchronization primitives

Creating a file in the %temp% directory

Loading a suspicious library

Creating a file

Deleting a recently created file

Creating a file in the Windows subdirectories

Creating a file in the Program Files subdirectories

Creating a service

Launching a service

Creating a process from a recently created file

Sending a custom TCP request

DNS request

Moving a file to the Windows subdirectory

Connection attempt

Using the Windows Management Instrumentation requests

Possible injection to a system process

Enabling autorun with the shell\open\command registry branches

Enabling autorun

Enabling autorun for a service

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug base64 CAB expand expired-cert installer installer lolbin overlay packed packed reconnaissance rundll32

Link:

https://www.filescan.io/uploads/6af8fd8dcc06d71dd1819161/reports/33d73d2a-bd6e-4845-86dd-0f150f224f7d/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/44072cefed23cb8d6ea255e2b62918c35249f6d760c41faf5da6714c35319c3e

Verdict:

Adware

File Type:

msi

Link:

https://opentip.kaspersky.com/44072cefed23cb8d6ea255e2b62918c35249f6d760c41faf5da6714c35319c3e/results?tab=lookup

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

.Net CAB:COMPRESSION:LZX CAB:COMPRESSION:NONE Executable Managed .NET Office Document PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) SOS: 0.21 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.27 SOS: 0.31 SOS: 0.32 SOS: 0.36 SOS: 0.39

Link:

https://app.malva.re/file/3701602b85dec6e6e5c4a95ad8a2d07d

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/44072cefed23cb8d6ea255e2b62918c35249f6d760c41faf5da6714c35319c3e/

Threat name:

ByteCode-MSIL.PUA.ConnectWise

Status:

Malicious

First seen:

2026-11-14 10:55:47 UTC

File Type:

Binary (Archive)

Extracted files:

181

AV detection:

11 of 36 (30.56%)

Threat level:

1/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=iqdsz37nepfy23vckxrlmkiyynjet5wxmdcb7l25uzyuynjrtq7a._file

Verdict:

malicious

Label(s):

ADMINTOOL_ScreenConnect

Link:

https://reports.threatray.com/b0203ee3-d4e3-4791-91b0-b27ac5ed5e5a

Result

Malware family:

n/a

Score:

8/10

Tags:

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Link:

https://tria.ge/reports/261115-avqg1afw61/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

Reads the TCP/IP host and domain name from the registry

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Boot or Logon Autostart Execution: Authentication Package

Drops file in System32 directory

Enumerates connected drives

ConnectWise ScreenConnect remote access tool

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Sets service image path in registry

Signed with revoked ConnectWise certificate

Malware Family:

n/a

Verdict:

Suspicious

Tags:

privilege_escalation rat stealer

YARA:

win_token ParentProcessEvasion

Link:

https://app.threat.zone/submission/8be3da2f-c539-4bbc-b40b-99d255e62a75

Malware Family:

connectwise

Malicious:

True

Tags:

msi obfuscated debug-check wmi-activity persistence adapter-discovery usb-check

Link:

https://intel.virussign.com/intelligence/file/44072cefed23cb8d6ea255e2b62918c35249f6d760c41faf5da6714c35319c3e

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	exploit_any_poppopret Create hunting rule
Author:	Jeff White [karttoon@gmail.com] @noottrak
Description:	Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.

Rule name:	INDICATOR_RMM_ConnectWise_ScreenConnect Create hunting rule
Author:	ditekSHen
Description:	Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	win_evilconwi_w0 Create hunting rule
Author:	Karsten Hahn @ G DATA CyberDefense
Description:	Settings from app.config that hide the connection of the client. These settings are potentially unwanted