🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 9


Intelligence 9 IOCs YARA 10 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77
SHA3-384 hash: 8f5774387ecc499a087e8710bbd7869f69bf02daecfb0b4a7c7ad3d005f03ea7d5d4fa47bc2cf5e6a9d08a8f61496b87
SHA1 hash: f15388fb52e60b669b4feb5beee3a68dbe445e49
MD5 hash: 396a9a33360a6597562033f7c6a09dfb
humanhash: island-network-harry-winter
File name:file
Download: download sample
Signature ConnectWise
Create hunting rule
File size:13'334'016 bytes
First seen:2026-09-16 20:10:09 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (49'239 x AgentTesla, 20'493 x Formbook, 12'372 x SnakeKeylogger)
ssdeep 196608:MdrUvHqHxcp9ym3nltDUJViHxcp9ym31Hxcp9ym3WHxcp9ym37Hxcp9ym3eHxcpp:Mdru4GplpBGpnGpkGpFGpsGp
TLSH T14ED623116BF89678E0B62A35E876A0B1A1377D119D23D26E23247D1E3C71E80C9B3777
TrID 55.8% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
20.6% (.EXE) UPX compressed Win32 Executable (27066/9/6)
5.0% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.9% (.EXE) Win64 Executable (generic) (6522/11/2)
3.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
Magika pebin
Reporter Bitsight
Tags:ConnectWise d52f85 dropped-by-amadey exe


Avatar
Bitsight
url: https://userhotels.org/Adobe%20Acrobat_Reader.exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
168
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-09-16 20:12:03 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f5a211cf-e9bb-4d71-b313-77b6b05a47a7

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/86004/
Verdict:
Malicious
Labled as:
Application.MSILheracles.Generic
Link:
https://www.hybrid-analysis.com/sample/6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-09T23:32:00Z UTC
Last seen:
2026-09-10T03:50:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77/results?tab=lookup
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/1c9009c2-4970-4780-ad7d-985724bcb422
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77
Verdict:
inconclusive
YARA:
11 match(es)
Tags:
.Net CAB:COMPRESSION:LZX CAB:COMPRESSION:NONE Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.13 SOS: 0.21 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.27 SOS: 0.31 SOS: 0.32 SOS: 0.36 SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/396a9a33360a6597562033f7c6a09dfb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77/
Threat name:
Win32.Trojan.Heracles
Create hunting rule
Status:
Malicious
First seen:
2026-09-10 01:13:42 UTC
File Type:
PE (.Net Exe)
Extracted files:
372
AV detection:
21 of 36 (58.33%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=nmpn5xxflwecfban2pjlezgqc5vaiaeqnrirdcgcshde4h7jvv3q._file
Verdict:
malicious
Label(s):
ADMINTOOL_ScreenConnect
Create hunting rule
Link:
https://reports.threatray.com/5769a0ae-cdfc-4909-a8af-3d66625566fc
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor discovery persistence privilege_escalation rat revoked_codesign upx
Link:
https://tria.ge/reports/260916-yxys6azv3k/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Boot or Logon Autostart Execution: Authentication Package
Drops file in System32 directory
UPX packed file
Enumerates connected drives
Checks computer location settings
ConnectWise ScreenConnect remote access tool
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Sets service image path in registry
Signed with revoked ConnectWise certificate
Unpacked files
SH256 hash:
6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77
MD5 hash:
396a9a33360a6597562033f7c6a09dfb
SHA1 hash:
f15388fb52e60b669b4feb5beee3a68dbe445e49
Link:
https://www.unpac.me/results/139e8bf2-0e1e-45c1-8788-8454f05e6621/
SH256 hash:
97b84fa4c5354b3a365506324a8c18a47d29f44bf11df156a0a7b6d90c881149
MD5 hash:
dcf86f7c4418573927d857fab3a1f8fd
SHA1 hash:
ff742b0cea02b0258a1a0366f3508b476bbc52f7
Link:
https://www.unpac.me/results/139e8bf2-0e1e-45c1-8788-8454f05e6621/
SH256 hash:
4adedcd57d2316469f0f770bbe27cbc2cc2ee17a2afa1b0dd5c5035b276cbc64
MD5 hash:
f9413637acdc0b26c7ce26fe95350ce5
SHA1 hash:
38c7e4e3105191573f4fbd2ef5e43ae8fd0b1fc1
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/139e8bf2-0e1e-45c1-8788-8454f05e6621/
Parent samples :
12362bc5540a6555344de62fcf224b0cb82990321e676d55b4ec0dfa0f7a50f0
462bf18e3a79cfc7806ff49f7360c9823917f358889ffa2b1683454cd78b82a2
a2e7c1094d6daffed68e5b529f6449c597b90e2a33611f8a4fcf700b77b6e6e8
a45ffc968bd621b31327de87d3e753e011a9514f4204aadad40cada2c12deb70
5a6a80b1e0ee11bc343d23fee6c9228efbc56d0149fe3abf03c847d94f9cffa7
4c917d92ded082bd8623d5e148d4b65ed02447bad3157cad8b66194b93150262
a080930b13f1b1b4340d53ecd748df7543adda9a474120f3c7fd82b9eadf1fc5
19daacc8d537a49d210cda5b997d115fc357d3ddaabed5a631bf99d2a243b9b7
69fbed675ed2cc4cc9991877e5a4d9f44bc246a4adca6b8f06296d6cae72b8b7
d3d2011ad308f8d994cb76e55ba54550f7d6ab8ac6f9fe68ea2a6bac9ae1cf30
63e026f67b8b214c75e95d8c126908c7cc64f5433dd739272931e37901432ce5
24124eb1bf1a1047ca8cd5316219cdd1bec183fae7c20792830c72a78579c3d4
5538ccedd54d89b6a3c08cfd892a00bbf64f00c0d1fcf407bde0f48fc1a7ee34
f8f6432d046b498e6c29df43a9cf67bd13d11b75a91c2aaa53b775197f026e7e
999aacf57a4a9e52f99c9f255275a804c7e3e6407de78ee50d8d050f5eebd896
a079c821fe67f2fbc39b378063301bf302987c399be4377bc16abbcd7bc68f35
af77310b15adddda32bcc40b9d013af4e4b1a842fd12035efd4b49ee1fc13718
5bc569f5e718886fd0402db1aa5fe06b439217d8d131c1eedbd62fe24482d30a
2347add3ded55b4d6a5ca5ddfd8667bba0cb25984dcbd60498700d97ebc138cd
3d0b397f1e38faa82011ed4267283c3afca23231ae70eb08f7c6943f5f09eed9
aa04dce309e673624bd6778de8ceb8c193b2412e48eb6b160b72fec00cbaacb4
89fdd3ee17e4586eb5cb9612828d98001160b97bad2fa6ae8452b897005b5352
1b75c42801e9a5bd3facc5e084897f76e42010be75e77bd0f2db6a1d52790834
9904267669ed90e0972a2e9409b4e83c43f19a70dec33a1cf4e1fc8b1119269e
8bba91fb8bc5629d55b2068e548843cea582365e712213533647e2e79525c4fa
b1c3070882a71893fbdc044e885861cf13301506d70205ec2a15f2b0ec4dd03a
e5f3bf349b598c769851fbede19d4ad8e49b286fdba30cb08c767a50d183eefc
13289da026158286a619c2aaa11efe2901ca5bb61c5d6b46681da338e7469cf7
a025f425022df0a0fe1ca8ec5e0554156a49cc2ae302b971878a6e7cc41d0677
d4f085a345cd8a3f662711ea7f8f72084bb7367085912028b7f4acc4e30f3d9e
4e1e49ae93572a44c1e0e0b3af40729dde0990066dac2a9abb510f0ec22bce00
b3a129f57bd99fc3226e7b469a2bce90d48495b1e5d2d7441bcec177c9d0702a
011fdaa3a7d7f7badc6088eda2a21fa808bcefe2c0cd24b21a89271102c5be60
0221824ccab033708283521d1d27a2cebc96bfe5db0b5c2d0f649d34603448c5
14dd855abb2530d9cf5f039ad1da6f15f2a5dac6ab2427adacb443cdda68af0c
14e7c8d684ce4cd36b77a756a5df2441f16d554e087c8cd25aa21a80173b70aa
23550640f394f3fae486838c74ebe4718d08dfb97f5d45cc35138d2c23373ed8
44de178bd97dc6f4585af80d4a1a38926324d04705fa11862cf4f08c294492cb
5513f6751654f5c64dee4ad09e0182d3c204d880f6ed91684bef55e66d7d8397
6d875d4ccf68851e9383322ca6404322ce953c974b92cabfc6211f29aca19000
7196de499911f0d3ce98f9a5da1097540ae10d1a70bc868b8ce68198de835161
51fc0d5c3759f6c916fac21356858645c73a873900443f7847f24132125f6b3e
5715c5499089b699183695ede91ee00882708d45df12d53a41745bd8ba17810f
768761ff027b87b0718ee7424ddb4be101583a259cdc27cff7810d4df29ce5a4
98c112ecfac96b785430e5c33131a60283f98c27615c76205df935642a0f5c05
aadf76e1f11d1b37b47dc8fe6a953ec1a5996045406d01bcfa15625ec343f6ce
f49c5ca09e04cfb0e5e8532946d183e9cce6595ce364a59b0c9423a828be8415
fede5a7846859bd1e62a6b7dbeea16d1c0edc6864e8780a3c13e200110268d8f
169b85eb15c09b3ff981fdffb6676b440f2c02bee83006dcbf662019a87bec0d
cba1ee4a393b13018670a55c94819fce1cc69580bbc6f7a4bc1b3cee3db21f85
3a07b5a8e85cfaf7f691de5e4c18332e479047beb46e2fc165cde64f3f56f8f9
dcdc579bee8f06e5472c5cbdf353a1d724994a729a2a39f6e0434b8e65012c2b
6d38b36349590b4397c151647df5fac0e19c84fa79b0d1977db4aedc480d1097
98e8d9c382b4639da213ec67d46575fd9b7c14649df1859fa6b05b209885084b
b71670e79f059d535a9b60974d34c8759e8d5db23206eed403bc826f5cdde0c9
97a0ced643015844c334578a2bb607cb282a8d645306128e937c62758c6b5b84
9d3a68a3bd616524ec2c1d83c5220f70b0d926bb38062dac9ad6aa2d3c336bfa
3cc948ec407ee63bd7d884497958a5f854d444b6937b6dd4cef3c06498c00ef4
d763126ad50e8d7bec7c88d8f5700f3fda49742aa8a413573f16f6a5cc916375
128c332d1be99551d813a7aa847b7dafb4860ed9a1737312c1521154d23f772c
343a723eea59c7eecdc6b559837d703dd592fb1d42dc39651b06570fd144a81e
cda030ad2d0076fc2fc96aae278fbf21b2244b27826d3890da32adb1e953a42d
a04e774417e18fb1ab0cf011c0c5942890c19416eac626d623107592a9686543
3ac64697f4e3c09f8d6d5ea2245e2fc902cfd7408f4e7ced5e4a66fab07cc9b1
d3519e90bc94dac255e7e315ad09dcaf45117d06c30a06c940e26d292d86d287
1a33e24658a1053f0af8c7c224ecb5aa756f539c8735d3a1cf023e6dcc638a03
64af163ca7bb37c54b3617c1938a56f975d748e2dec0ea86f63206e18450aa64
ed30e2cbed65507f1805f9c6a9f05789ea8d8106ab139ee81d7c597caf815b00
f98e988c71ba3ae51146d0a2843c8a694a23b40922bc001131b98e00b3d5edb3
edc73cf039196893ce93018f5fef4057f90a80447c9b7bf55b91a91b423abde1
137d06e4b5009f494fd546fc87eb9fa1dcadf35664cecaeb36416c359f803a86
b34d9f8bb178e1521ba4d62ee575563872e09153c5741a3f454bfa03083498ad
aa35ff5e481184ac1c98143e3b8eb22564f1ab521c9fa1350b8854e6cc4f1f90
b10aa8116a3f9666386596e4a8ba7b9e4a58355b2ce232cd8ff5468d3328d0c0
f07b7c03905657fe4ae3ebe52ffb81df7c04c520a1688bdaef2a2771240a086a
04a6b6d4e614262a3883280660e67d32323a2651fd35e3065c6a08c51a460966
b7b723412334e3054b3050fcd55a42648b1e47430b59e1b48d8e2efb579c301a
40a49b61a61a99c570b6c1e01f437dac7f8e0c7ad8cdfba407884cec37ba8b1b
68219544dd25a1ab4c2d7184af63a3a367f2850cd4e3b927ab498d27a8960ea8
2e2a134122cb568f735675cc406e154fe21db32449e21449360dad5a6cc0b98f
b453f582ff32c59edefbdecc1303bca5976ecca56297f59db56b3b0a3722130d
12373fefe4af84589a820c4cb9eede775d2bbea6524014cf1e539a926ace419a
d9b69fe371aa57cbe7b0e4b9221902cb207f7150693976a97beb8e59115c365a
3ce79686136a1c32b60dc6f2b645f98fde3b1def58f6bcbcbc5fd15937a525e9
b2b7a4513002ef7e08a53440f1c57801c0f6113e7f22363f929e39c37188f6b7
b0fd6e0a4bea2502d98173fffd5fb8d35c1987d141d3f77df929a5253e9201b5
0eb45fdc5504805d34596dd7063c686536726536dd8300c030044d01521be41b
7f1bf2b8f4a5119bc13b7ccc9c6d3d243992b51801b3af2ad7a1b52e722d6bfd
fd54e12a3dde03c477c48d8f8d4d070bc691cf386154f0df5b42e3c561450538
a107ca6f200ff774013557aec838a976d9425b1faabd65d8289e2ab71f648c3c
28d65f871d2b7aabc8fe8a13dfca6a48b2d87a49e80773d9e62cbb955beb0761
32431111b40d7b556a58822361a83566f2fd7dd8270dc58b9f7698cac7ff0f21
e490fc1f6a3114f2231bf172c5de58de5c0b3905baf6b041fd404cdac2dc33f3
741e08674386ac5c0679b120208867595f5ab89e5320eca5519b57f610b73d4e
7ef03054d3a602d418a382b00f10970148ce87d107f7d06e9fa5da71c8e4d3da
d2305c675ac7cb8f607c06fff1268ae695213ce2de21f8bf78b65a17792a0c3b
0b1a48a1c9ba729699cfa990a09139899447d209c15452d96ae5c6dcfcf1d132
31e86217e63c1b64cc459a6bd2b8cf90770821a6b2c34573a3539a1381039ef8
b03c4d9b4c6f16f79b63e119e75447274786ef4e9ca3168af8898ed40d2bdd37
6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77
0705daac7dbdb5c3814088256e6d4e45e844b35b183c6cd50b9595384fb44276
dec6179f59f4e68b4f28c973de83bf4c365f578402e98867d8914dd13a3dbe5b
f8876963e58c9f376730a47b22992b24d28a33b0e1b2ff64c7ef8d73707772d0
SH256 hash:
8e7783dec955ee271d9d79c305a90dce1b4f2522948d4fe343fa63df7e37854d
MD5 hash:
f28a1bd8565a229baa2eed3a4188c4b2
SHA1 hash:
7496d48f61bd9ec47680eb804077b65f2175107d
Link:
https://www.unpac.me/results/139e8bf2-0e1e-45c1-8788-8454f05e6621/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_imphash
Create hunting rule
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:UPX
Create hunting rule
Author:kevoreilly
Description:UPX Unpacker: dump on OEP (original entry point)
Rule name:UPXV200V290MarkusOberhumerLaszloMolnarJohnReiser
Create hunting rule
Author:malware-lu

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ConnectWise

Executable exe 6b1ededee55d8822840dd3d2b264d0176a0400906c511188c291c64e1fe9ad77

(this sample)

  
Dropped by
Amadey
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/86004/
  
URLhaus
https://urlhaus.abuse.ch/url/3917845/

Comments