MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 54093a290bb379a426446500bb0ec5c0c8d669ae46e37e2628e60a114d7954e2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 10

Intelligence 10 IOCs YARA 4 File information Comments

SHA256 hash:	54093a290bb379a426446500bb0ec5c0c8d669ae46e37e2628e60a114d7954e2
SHA3-384 hash:	17ae2b067bd2385c9e3d7018fd8316f0d53d4c9c62748cdf590d4dda44d922ebd8f8b60cc3c9aad1d0f05123707aa2be
SHA1 hash:	dc342a2b64d7857a4638e75d2f535db7678f2f15
MD5 hash:	4229ed94d753627f8db2d3ed0506e30e
humanhash:	comet-quiet-ceiling-grey
File name:	GoogleMeet-x64.vbs
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	6'030 bytes
First seen:	2026-01-16 12:53:08 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	96:IazFw41mGBg6lNBXmUjhivcVV/ic34M7p/+1aC/imi2w6/f42dD/Km/Jcy4pj:1zCWlIoV/iDYp/+p/df/goD/Km/w
Threatray	1'132 similar samples on MalwareBazaar
TLSH	T155C13F0FBD0BA6306933533796977D1EEAA1646312120C25B9DE8187DF31658F7212FB
Magika	vba
Reporter	juroots
Tags:	ConnectWise vbs

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/49075/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=696a34d057243ef151cd9016

Tags:

shellcode phishing dropper spawn

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive expand lolbin msiexec rundll32 wscript

Link:

https://www.filescan.io/uploads/696a34c69c4da7d847351902/reports/35dd4f46-6437-4e5f-8db4-ddf471ac6afe/overview

Verdict:

Malicious

Labled as:

VBS/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/54093a290bb379a426446500bb0ec5c0c8d669ae46e37e2628e60a114d7954e2

Result

Gathering data

Verdict:

Malicious

File Type:

VBScript

Detections:

BSS:Trojan.Win32.Generic.nblk BSS:Trojan.Win32.Generic Trojan-Downloader.JS.SLoad.sb HEUR:Trojan.Script.Generic not-a-virus:RemoteAdmin.MSIL.ConnectWise.d not-a-virus:RemoteAdmin.MSIL.ConnectWise.c not-a-virus:RemoteAdmin.MSIL.ConnectWise.b not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen not-a-virus:RemoteAdmin.MSIL.ConnectWise.a

Link:

https://opentip.kaspersky.com/54093a290bb379a426446500bb0ec5c0c8d669ae46e37e2628e60a114d7954e2/results?tab=lookup

Score:

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/54093a290bb379a426446500bb0ec5c0c8d669ae46e37e2628e60a114d7954e2

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/54093a290bb379a426446500bb0ec5c0c8d669ae46e37e2628e60a114d7954e2/

Verdict:

Malicious

Link:

https://tip.neiki.dev/file/54093a290bb379a426446500bb0ec5c0c8d669ae46e37e2628e60a114d7954e2

Threat name:

Script.Trojan.Heuristic

Status:

Malicious

First seen:

2026-01-16 12:54:28 UTC

File Type:

Text (VBS)

AV detection:

6 of 36 (16.67%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=kqetukilwn42ijsemualwdwfydenm2noi3rx4jri4yfbctlzktra._file

Verdict:

malicious

Label(s):

admintool_screenconnect

ConnectWise

134052b5cec1c75432a826156b2e03cae7f54dc076e201d3253573a230cf7b46

ConnectWise

99e7b628ee17aca20a951378ea88373f0208e48b80fc85b8936099ae570b5a77

ConnectWise

acaa6d40c3adbd7079e1411de4e33782ebd5c118baca2ab01562e7f2220e8eab

ConnectWise

b6928d89c300d9d317a8ea884f382acba1af0237d93ae4d88d9821c780b41a0f

ConnectWise

c8f5a4d26b10be34a2b865ad914b296f3618998d42e1c12ef0374c014b8bac58

ConnectWise

cdd8ac48dcfa2f4ea670ec74601f12c580d1c303e507532750ebcc0615952066

ConnectWise

error

ConnectWise

f50bb85de2859695c5a82a061f9bb4ca53a96df654b3555f67bcacb7150d53fc

ConnectWise

fab6011a3cb8ae1a26d6b5267510c63cfd3f36ee912d5d9c367991b33b61b41a

ConnectWise

fc7ee0a9cffabfd03e1b972bcbfd4504289482f86c83c391165ebe5253995ef9

ConnectWise

+ 1'122 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

backdoor discovery persistence privilege_escalation rat revoked_codesign

Link:

https://tria.ge/reports/260116-p4tckshv4e/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Boot or Logon Autostart Execution: Authentication Package

Drops file in System32 directory

Enumerates connected drives

Checks computer location settings

ConnectWise ScreenConnect remote access tool

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Binary is signed using a ConnectWise certificate revoked for key compromise.

Sets service image path in registry

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/54093a290bb379a426446500bb0ec5c0c8d669ae46e37e2628e60a114d7954e2

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	detect_tiny_vbs Create hunting rule
Author:	daniyyell
Description:	Detects tiny VBS delivery technique

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	WIN_ClickFix_Detection Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects ClickFix social engineering technique using 'Verify you are human' messages and malicious PowerShell commands
Reference:	ClickFix social engineering and malicious PowerShell commands