🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 11


Intelligence 11 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae
SHA3-384 hash: 9d4b50f1c5bce827a27fee0ceff914f78ef7704bbd73477523e99164768a59d3b20eee9d5de25a4ffb251777c4e31b69
SHA1 hash: 193b2c45f3c236cb159d54edc240e0002b3f204f
MD5 hash: 12d98c451062723916262ceb94d61320
humanhash: enemy-oregon-happy-lemon
File name:Emurgo-Installer-Winx64-Setup-v2.5.3.bat
Download: download sample
Signature ConnectWise
Create hunting rule
File size:12'014'422 bytes
First seen:2026-11-13 08:47:56 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 49152:j7D2PkKsPMjVgatBnMKAoMwkOce0XfKiE+mi6zEzsEn0b/eXkLKhz0e4J8eKzXK9:S
TLSH T1B0C6233A99416BDF0F1976A561093E026D9827635F41232EEB8C416138E8670DF7EEFC
Magika batch
Reporter abuse_ch
Tags:bat ConnectWise rmm screenconnect

Intelligence

File Origin
# of uploads :
1
# of downloads :
75
Origin country :
SE SE
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/f477708d-9426-41a0-970d-861c2859f792/
Malware family:
n/a
ID:
1
File name:
bat
Verdict:
Malicious activity
Analysis date:
2026-11-13 08:56:01 UTC
Tags:
uac-bypass screenconnect tool rmm-tool remote auto rdp rat auto-reg auto-startup
Link:
https://app.any.run/tasks/bce776ea-2b94-4ded-99d9-090efaabb0f4

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99768/
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
99.1%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af6ced683200b505eda5e69
Tags:
vmdetect rapid
Gathering data
Verdict:
Malicious
Labled as:
PHP.Loader.2.Generic
Link:
https://www.hybrid-analysis.com/sample/6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae
Verdict:
Unknown
File Type:
unix shell
Link:
https://opentip.kaspersky.com/6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae/results?tab=lookup
Result
Threat name:
ScreenConnect Tool
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2005239
Signature
Bypasses PowerShell execution policy
Creates files in the system32 config directory
Enables network access during safeboot for specific services
Found large BAT file
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies security policies related information
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suspicious powershell command line found
Yara detected EXE embedded in BAT file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2005239 Sample: Emurgo-Installer-Winx64-Set... Startdate: 13/11/2026 Architecture: WINDOWS Score: 100 101 relay.lecoindudiabetique.com 2->101 103 eip-terr-na.cdp1.digicert.com.akahost.net 2->103 105 Malicious sample detected (through community Yara rule) 2->105 107 Multi AV Scanner detection for dropped file 2->107 109 Multi AV Scanner detection for submitted file 2->109 111 5 other signatures 2->111 9 msiexec.exe 155 151 2->9         started        13 cmd.exe 3 2->13         started        15 svchost.exe 2->15         started        17 11 other processes 2->17 signatures3 process4 dnsIp5 89 C:\Windows\Installer\MSIEC4D.tmp, PE32+ 9->89 dropped 91 C:\Windows\Installer\MSIE5C4.tmp, PE32 9->91 dropped 93 C:\Windows\Installer\MSIE42D.tmp, PE32+ 9->93 dropped 95 37 other files (35 malicious) 9->95 dropped 113 Enables network access during safeboot for specific services 9->113 115 Modifies security policies related information 9->115 20 msiexec.exe 9->20         started        22 msiexec.exe 9->22         started        34 6 other processes 9->34 117 Suspicious powershell command line found 13->117 119 Bypasses PowerShell execution policy 13->119 24 SecondInstaller.exe 13->24         started        27 powershell.exe 8 13->27         started        30 powershell.exe 13->30         started        36 4 other processes 13->36 32 drvinst.exe 15->32         started        97 relay.lecoindudiabetique.com 94.154.32.61, 8041 STELLARGROUPSASFR France 17->97 99 127.0.0.1 unknown unknown 17->99 38 3 other processes 17->38 file6 signatures7 process8 file9 40 rundll32.exe 20->40         started        43 rundll32.exe 22->43         started        63 C:\Windows\Temp\...\SecondInstaller.exe, PE32 24->63 dropped 45 SecondInstaller.exe 24->45         started        121 Found suspicious powershell code related to unpacking or dynamic code loading 27->121 123 Powershell drops PE file 27->123 65 C:\Users\user\AppData\...\SecondInstaller.exe, PE32 30->65 dropped 67 C:\Windows\System32\...\SETF07B.tmp, PE32+ 32->67 dropped 69 DocuSignPrintDrive...erFilter.dll (copy), PE32+ 32->69 dropped 47 rundll32.exe 32->47         started        50 conhost.exe 38->50         started        signatures10 process11 file12 71 C:\Windows\...\ScreenConnect.Windows.dll, PE32 40->71 dropped 73 C:\...\ScreenConnect.InstallerActions.dll, PE32 40->73 dropped 75 C:\Windows\...\ScreenConnect.Core.dll, PE32 40->75 dropped 83 4 other malicious files 40->83 dropped 85 2 other malicious files 43->85 dropped 77 C:\Windows\...\Docusign Print Driver x64.exe, PE32 45->77 dropped 79 DocuSign.Bootstrap...ation.resources.dll, PE32 45->79 dropped 81 DocuSign.Bootstrap...ation.resources.dll, PE32 45->81 dropped 87 14 other malicious files 45->87 dropped 52 Docusign Print Driver x64.exe 45->52         started        125 Creates files in the system32 config directory 47->125 signatures13 process14 file15 55 C:\Users\user\AppData\Local\...\MSIC9F5.tmp, PE32 52->55 dropped 57 C:\Users\user\AppData\Local\...\MSIB330.tmp, PE32 52->57 dropped 59 C:\Users\user\AppData\Local\...\MSIA10E.tmp, PE32+ 52->59 dropped 61 C:\...\Docusign Print Driver x64.exe, PE32 52->61 dropped
Score:
34%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae/
Threat name:
Script-PHP.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-11-12 12:51:56 UTC
File Type:
Text
AV detection:
9 of 36 (25.00%)
Threat level:
  2/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=nwjm23co6o7gftjnlonmja3ww6onsv5kk2lnb4i3uegx5ptx3gxa._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware backdoor defense_evasion discovery execution persistence privilege_escalation ransomware rat revoked_codesign spyware trojan
Link:
https://tria.ge/reports/261113-kqlclahz3r/
Behaviour
Uses Volume Shadow Copy service COM API
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of SendNotifyMessage
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Runs net.exe
Modifies system certificate store
Modifies registry class
Modifies data under HKEY_USERS
Modifies Internet Explorer settings
Checks processor information in registry
Checks SCSI registry key(s)
Executes a command shell one-liner
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Windows directory
Drops file in Program Files directory
Drops file in System32 directory
Boot or Logon Autostart Execution: Authentication Package
Enumerates connected drives
Command and Scripting Interpreter: PowerShell
Checks installed software on the system
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Event Triggered Execution: Component Object Model Hijacking
ConnectWise ScreenConnect remote access tool
Checks computer location settings
Signed with revoked ConnectWise certificate
Sets service image path in registry
Manipulates Digital Signatures
Boot or Logon Autostart Execution: Port Monitors
Malware Family:
loader
Create hunting rule
Malicious:
True
Tags:
bat
Link:
https://intel.virussign.com/intelligence/file/6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ConnectWise

Batch (bat) bat 6d92cd6c4ef3be62cd2d5b9ac48376b79cd957aa5696d0f11ba10d7ebe77d9ae

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/4064486/
  
Delivery method
Distributed via web download
  
URLhaus
https://urlhaus.abuse.ch/url/4064487/
Cape
Cape
https://www.capesandbox.com/analysis/99768/

Comments