🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 51d159b6b0ba7ff2a9d38ae9bdb07cb5153b06fe34fca176ac03594fa257ca11. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 12


Intelligence 12 IOCs YARA 17 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 51d159b6b0ba7ff2a9d38ae9bdb07cb5153b06fe34fca176ac03594fa257ca11
SHA3-384 hash: 161e92a05e55860f9b1e3b1f6760886f7bc356022e40a86d20e75598478e70d80410da296492fe9c4d8f96f2a42d260f
SHA1 hash: 87a8da2daf2255a921757b60ec24332454f87cf9
MD5 hash: 3074e2727efa81d4e22796aaa86ac300
humanhash: uranus-texas-sixteen-nebraska
File name:51d159b6b0ba7ff2a9d38ae9bdb07cb5153b06fe34fca176ac03594fa257ca11.msi
Download: download sample
Signature ConnectWise
Create hunting rule
File size:14'741'504 bytes
First seen:2026-11-05 00:13:22 UTC
Last seen:Never
File type:Microsoft Software Installer (MSI) msi
MIME type:application/x-msi
ssdeep 196608:HHxcp9ym3MltDUJVbVHxcp9ym3kHxcp9ym3UHxcp9ym3NHxcp9ym3vHxcp9ym3tE:xGpKp0HGpCGpyGp/Gp5GpfGp
TLSH T165E62312A7F852BCE0B69634DD765562E6367C060B21D5AF5364B91E2D32EC08E73333
TrID 80.0% (.MSI) Microsoft Windows Installer (454500/1/170)
10.7% (.MST) Windows SDK Setup Transform script (61000/1/5)
7.8% (.MSP) Windows Installer Patch (44509/10/5)
1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika msi
Reporter Tuxxin
Tags:ConnectWise msi signed

Code Signing Certificate

Organisation:d0ed7fb5a2b8f4a3
Issuer:d0ed7fb5a2b8f4a3 Root
Algorithm:sha256WithRSAEncryption
Valid from:2023-04-01T00:00:00Z
Valid to:2038-01-01T00:00:00Z
Serial number: 00
Intelligence: 366 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:SHA256
Thumbprint: 330def639c28517f5c9aa54bdeb8804c4440e9b6082edb59884bb803f1f6ad3f
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
70
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
MSI
Details
Link:
https://research.acce.ciphertechsolutions.com/results/b22f7d55-bf32-4671-be45-6da1b58ec413/
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/97264/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6aebca587d28ff7e598cb017
Tags:
shellcode dropper ordin spam
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Creating synchronization primitives
Searching for synchronization primitives
Creating a file in the %temp% directory
Loading a suspicious library
Creating a file
Deleting a recently created file
Creating a file in the Windows subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Enabling the 'hidden' option for recently created files
Running batch commands
Launching a process
Creating a file in the Program Files subdirectories
DNS request
Creating a service
Connection attempt
Launching a service
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Moving a file to the Windows subdirectory
Possible injection to a system process
Unauthorized injection to a recently created process
Enabling autorun with the shell\open\command registry branches
Enabling autorun
Enabling autorun for a service
Gathering data
Verdict:
Malicious
Labled as:
Malware.Generic
Link:
https://www.hybrid-analysis.com/sample/51d159b6b0ba7ff2a9d38ae9bdb07cb5153b06fe34fca176ac03594fa257ca11
Verdict:
Malicious
File Type:
msi
First seen:
2026-11-04T22:54:00Z UTC
Last seen:
2026-11-04T23:05:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/51d159b6b0ba7ff2a9d38ae9bdb07cb5153b06fe34fca176ac03594fa257ca11/results?tab=lookup
Result
Threat name:
ScreenConnect Tool
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1998621
Signature
.NET source code references suspicious native API functions
AI detected suspicious PE / MSI digital signature
Antivirus detection for dropped file
Antivirus detection for URL or domain
Contains functionality to capture and log keystrokes
Contains functionality to change the desktop window for a process (likely to hide graphical interactions)
Contains functionality to hide user accounts
Creates an autostart registry key pointing to binary in C:\Windows
Creates files in the system32 config directory
Drops executables to the windows directory (C:\Windows) and starts them
Enables network access during safeboot for specific services
Found API chain indicative of sandbox detection
Joe Sandbox ML detected suspicious sample
Modifies security policies related information
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Potential Privilege Escalation using Task Scheduler highest RunLevel
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Schtasks Creation Or Modification With SYSTEM Privileges
Uses ping.exe to check the status of other devices and networks
Uses ping.exe to sleep
Uses schtasks.exe or at.exe to add and modify task schedules
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1998621 Sample: JMLDaZXQor.msi Startdate: 05/11/2026 Architecture: WINDOWS Score: 100 119 xwszdkj.com 2->119 121 api.ipify.org 2->121 127 Antivirus detection for URL or domain 2->127 129 Multi AV Scanner detection for dropped file 2->129 131 Multi AV Scanner detection for submitted file 2->131 133 6 other signatures 2->133 11 msiexec.exe 94 52 2->11         started        15 WinUpdater.exe 2->15         started        17 ScreenConnect.ClientService.exe 2->17         started        20 7 other processes 2->20 signatures3 process4 dnsIp5 105 C:\Windows\Installer\MSI8FF9.tmp, PE32 11->105 dropped 107 C:\Windows\Installer\MSI8C20.tmp, PE32 11->107 dropped 109 C:\Windows\Installer\MSI8345.tmp, PE32 11->109 dropped 113 10 other malicious files 11->113 dropped 151 Drops executables to the windows directory (C:\Windows) and starts them 11->151 153 Enables network access during safeboot for specific services 11->153 155 Modifies security policies related information 11->155 22 MSI8345.tmp 4 11->22         started        26 msiexec.exe 11->26         started        34 2 other processes 11->34 157 Creates files in the system32 config directory 15->157 28 cmd.exe 15->28         started        30 WinUpdater.exe 15->30         started        36 3 other processes 15->36 117 134.33.65.65, 49714, 8041 MICROSOFT-CORP-MSN-AS-BLOCK-MicrosoftCorporationUS United States 17->117 38 2 other processes 17->38 111 C:\Users\user\AppData\Local\...\MSIEB26.tmp, PE32 20->111 dropped 32 cmd.exe 20->32         started        40 4 other processes 20->40 file6 signatures7 process8 file9 93 C:\ProgramData\SysMgr\WinUpdater.exe, PE32+ 22->93 dropped 135 Antivirus detection for dropped file 22->135 137 Multi AV Scanner detection for dropped file 22->137 42 WinUpdater.exe 4 20 22->42         started        46 rundll32.exe 11 26->46         started        139 Uses ping.exe to sleep 28->139 52 2 other processes 28->52 141 Drops executables to the windows directory (C:\Windows) and starts them 30->141 54 2 other processes 30->54 56 2 other processes 32->56 48 schtasks.exe 36->48         started        50 schtasks.exe 36->50         started        58 3 other processes 36->58 143 Contains functionality to hide user accounts 38->143 60 2 other processes 40->60 signatures10 process11 file12 95 C:\Windows\Temp\WinUpdater.exe, PE32+ 42->95 dropped 145 Antivirus detection for dropped file 42->145 147 Multi AV Scanner detection for dropped file 42->147 62 WinUpdater.exe 15 19 42->62         started        66 cmd.exe 1 42->66         started        68 schtasks.exe 1 42->68         started        70 schtasks.exe 42->70         started        97 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 46->97 dropped 99 C:\...\ScreenConnect.InstallerActions.dll, PE32 46->99 dropped 101 C:\Users\user\...\ScreenConnect.Core.dll, PE32 46->101 dropped 103 4 other malicious files 46->103 dropped 149 Contains functionality to hide user accounts 46->149 72 conhost.exe 48->72         started        74 conhost.exe 50->74         started        signatures13 process14 dnsIp15 123 xwszdkj.com 43.156.63.124, 49708, 49709, 49715 TENCENT-NET-AP-CNTencentBuildingKejizhongyiAvenueCN Singapore 62->123 125 api.ipify.org 172.67.74.152, 443, 49710, 49711 CLOUDFLARENET-CloudflareIncUS Canada 62->125 159 Multi AV Scanner detection for dropped file 62->159 161 Contains functionality to change the desktop window for a process (likely to hide graphical interactions) 62->161 163 Found API chain indicative of sandbox detection 62->163 169 4 other signatures 62->169 76 schtasks.exe 1 62->76         started        78 schtasks.exe 62->78         started        165 Uses ping.exe to sleep 66->165 167 Uses ping.exe to check the status of other devices and networks 66->167 80 PING.EXE 1 66->80         started        83 conhost.exe 66->83         started        85 conhost.exe 68->85         started        87 conhost.exe 70->87         started        signatures16 process17 dnsIp18 89 conhost.exe 76->89         started        91 conhost.exe 78->91         started        115 127.0.0.1 unknown unknown 80->115 process19
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
.Net CAB:COMPRESSION:LZX CAB:COMPRESSION:NONE Executable Managed .NET Office Document PDB Path PE (Portable Executable) PE File Layout PE Memory-Mapped (Dump) SOS: 0.00 SOS: 0.21 SOS: 0.23 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.27 SOS: 0.31 SOS: 0.32 SOS: 0.36 SOS: 0.39
Link:
https://app.malva.re/file/3074e2727efa81d4e22796aaa86ac300
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/51d159b6b0ba7ff2a9d38ae9bdb07cb5153b06fe34fca176ac03594fa257ca11/
Threat name:
Win64.Trojan.Tedy
Create hunting rule
Status:
Malicious
First seen:
2026-11-04 21:46:12 UTC
File Type:
Binary (Archive)
Extracted files:
180
AV detection:
18 of 24 (75.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=khivtnvqxj77fkotrlu33md4wuktwbx6gt6kc5vmanmu7isxziiq._file
Verdict:
malicious
Label(s):
ADMINTOOL_ScreenConnect
Create hunting rule
Link:
https://reports.threatray.com/61eba927-e0a1-449a-adf9-6969921486ab
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor discovery execution persistence privilege_escalation ransomware rat revoked_codesign
Link:
https://tria.ge/reports/261105-ajdn3afa75/
Behaviour
Uses Volume Shadow Copy service COM API
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: GetForegroundWindowSpam
Suspicious behavior: EnumeratesProcesses
Scheduled Task/Job: Scheduled Task
Runs ping.exe
Modifies registry class
Modifies data under HKEY_USERS
Checks processor information in registry
Checks SCSI registry key(s)
Enumerates physical storage devices
Event Triggered Execution: Installer Packages
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
System Network Configuration Discovery: Internet Connection Discovery
Drops file in Windows directory
Drops file in Program Files directory
Drops file in System32 directory
Boot or Logon Autostart Execution: Authentication Package
Looks up external IP address via web service
Enumerates connected drives
Badlisted process makes network request
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Event Triggered Execution: Component Object Model Hijacking
ConnectWise ScreenConnect remote access tool
Checks computer location settings
Signed with revoked ConnectWise certificate
Sets service image path in registry
Malware Family:
Gootkit
Create hunting rule
Verdict:
Malicious
Tags:
invalid_signature gootkit config_extracted stealer privilege_escalation rat
YARA:
external_ip_check WMI_strings ProcessInjectionTargets ParentProcessEvasion DelayBatch
Link:
https://app.threat.zone/submission/10fd371c-4777-4a51-b0f8-afc5fcf449f6
Malware Config
C2 Extraction:
AppDataCacheMgr
AppDataCacheService
Microsoft\FontCache
FontCacheSvc.exe
C:\Windows\Syste
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/51d159b6b0ba7ff2a9d38ae9bdb07cb5153b06fe34fca176ac03594fa257ca11

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CMD_Ping_Localhost
Create hunting rule
Rule name:cobalt_strike_tmp01925d3f
Create hunting rule
Author:The DFIR Report
Description:files - file ~tmp01925d3f.exe
Reference:https://thedfirreport.com
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerException__SetConsoleCtrl
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:FreddyBearDropper
Create hunting rule
Author:Dwarozh Hoshiar
Description:Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ConnectWise

Microsoft Software Installer (MSI) msi 51d159b6b0ba7ff2a9d38ae9bdb07cb5153b06fe34fca176ac03594fa257ca11

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/97264/

Comments