🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 19


Intelligence 19 IOCs YARA 33 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
SHA3-384 hash: 04b494ada7c150ac1e70c03092c5e96ef63c6e2caf563b6d27aff57b429ce1317f9a1e342d0ec0676414cae3840d5281
SHA1 hash: f7942088103a877441839f4bca791243c9953a81
MD5 hash: 0f01f5e2886a4be432d5a4f9fd1f93bb
humanhash: mars-summer-don-may
File name:6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d.exe
Download: download sample
Signature ConnectWise
Create hunting rule
File size:12'846'648 bytes
First seen:2026-11-11 00:36:55 UTC
Last seen:Never
File type:Executable exe
MIME type:application/vnd.microsoft.portable-executable
imphash 9771ee6344923fa220489ab01239bdfd (861 x ConnectWise)
ssdeep 196608:pmfefPxMOo/K6Sdr3tBiCFKpj10ZMOo/K6Sdr3t+MOo/K6Sdr3ttMOo/K6Sdr3tS:byK6c/1K70ZyK6cUyK6cDyK6cM
TLSH T161D61210B3E692B9E1BF0678D83AA2655A75BC054752C3EF53947D692D32BC08B313B3
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Tuxxin
Tags:ConnectWise exe signed

Code Signing Certificate

Organisation:ConnectWise, LLC
Issuer:DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:sha256WithRSAEncryption
Valid from:2026-02-20T00:00:00Z
Valid to:2027-02-19T23:59:59Z
Serial number: 01dddbc6e9163d407d980a3eaf798528
Intelligence: 175 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:SHA256
Thumbprint: e1db8670d34a3d8099b9815c9772b37025a7b5d1845ec5256eb22dad7e196725
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
172
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
ScreenConnect
Details
Link:
https://research.acce.ciphertechsolutions.com/results/00d8a2a4-a577-4b1c-9bd9-3a8df6f7a657/
Malware family:
connectwise
Create hunting rule
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-11-11 01:03:26 UTC
Tags:
screenconnect rmm-tool tool remote connectwise rat
Link:
https://app.any.run/tasks/e7b6f656-477c-4d95-9fab-2ee9eb666081

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/99285/
Verdict:
Malicious
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af3b8b9beffd05f052aed03
Tags:
connectwise dropper ordin virus
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
anti-debug base64 corrupted evasive hacktool installer-heuristic microsoft_visual_cc overlay packed packed privilege reconnaissance signed
Link:
https://www.filescan.io/uploads/6af3b8b606700de8d6f9d817/reports/ce2a78b0-9cfc-4bd5-af27-a4520eb18c04/overview
Verdict:
Malicious
Labled as:
HackTool/ConnectWiseControl.i
Link:
https://www.hybrid-analysis.com/sample/6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
Malware family:
ConnectWise Inc
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/dbc0e2a3-e199-455c-a9d4-4658d3a3958b
Result
Threat name:
ScreenConnect Tool
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/2003755
Signature
.NET source code contains potential unpacker
.NET source code references suspicious native API functions
Contains functionality to hide user accounts
Creates files in the system32 config directory
Enables network access during safeboot for specific services
Joe Sandbox ML detected suspicious sample
Modifies security policies related information
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Powershell connects to network
Sigma detected: Remote Access Tool - ScreenConnect Backstage Mode Anomaly
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: Suspicious Script Execution From Temp Folder
Suricata IDS alerts for network traffic
Suspicious powershell command line found
System process connects to network (likely due to code injection or exploit)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2003755 Sample: 2ooKP2erFN.exe Startdate: 11/11/2026 Architecture: WINDOWS Score: 60 91 newjmendeals.abrdns.com 2->91 93 instance-idqrcl-relay.screenconnect.com 2->93 95 2 other IPs or domains 2->95 103 Suricata IDS alerts for network traffic 2->103 105 Multi AV Scanner detection for dropped file 2->105 107 Multi AV Scanner detection for submitted file 2->107 109 7 other signatures 2->109 9 msiexec.exe 188 101 2->9         started        13 ScreenConnect.ClientService.exe 2->13         started        16 2ooKP2erFN.exe 6 2->16         started        18 ScreenConnect.ClientService.exe 2->18         started        signatures3 process4 dnsIp5 55 C:\Windows\Installer\MSIE869.tmp, PE32 9->55 dropped 57 C:\Windows\Installer\MSIE599.tmp, PE32 9->57 dropped 59 C:\Windows\Installer\MSIE1CF.tmp, PE32 9->59 dropped 65 22 other files (20 malicious) 9->65 dropped 115 Enables network access during safeboot for specific services 9->115 117 Modifies security policies related information 9->117 20 msiexec.exe 9->20         started        22 msiexec.exe 9->22         started        36 2 other processes 9->36 101 server-ovh1027972-relay.screenconnect.com 15.204.241.181, 443, 49745 OVHFR United States 13->101 61 C:\Windows\SystemTemp\...\tXUHKAE0Gk2Trun.cmd, ASCII 13->61 dropped 24 cmd.exe 13->24         started        27 ScreenConnect.WindowsClient.exe 13->27         started        38 2 other processes 13->38 63 C:\Users\user\AppData\...\2ooKP2erFN.exe.log, ASCII 16->63 dropped 119 Contains functionality to hide user accounts 16->119 29 msiexec.exe 8 16->29         started        32 ScreenConnect.WindowsClient.exe 18->32         started        34 ScreenConnect.WindowsClient.exe 18->34         started        file6 signatures7 process8 file9 40 rundll32.exe 15 13 20->40         started        45 rundll32.exe 12 20->45         started        47 rundll32.exe 11 20->47         started        49 rundll32.exe 22->49         started        111 Suspicious powershell command line found 24->111 51 powershell.exe 24->51         started        113 Contains functionality to hide user accounts 27->113 85 C:\Users\user\AppData\Local\...\MSI390A.tmp, PE32 29->85 dropped 87 C:\Users\user\AppData\Local\...\MSI311A.tmp, PE32 29->87 dropped 89 C:\Users\user\AppData\Local\...\MSI2D41.tmp, PE32 29->89 dropped signatures10 process11 dnsIp12 97 check.screenconnect.com 44.217.253.46, 443, 49743 AMAZON-AES-AmazoncomIncUS United States 40->97 77 8 other malicious files 40->77 dropped 121 System process connects to network (likely due to code injection or exploit) 40->121 123 Contains functionality to hide user accounts 40->123 79 8 other malicious files 45->79 dropped 67 C:\...\ScreenConnect.WindowsInstaller.dll, PE32 47->67 dropped 81 7 other malicious files 47->81 dropped 69 C:\Windows\...\ScreenConnect.Windows.dll, PE32 49->69 dropped 71 C:\...\ScreenConnect.InstallerActions.dll, PE32 49->71 dropped 73 C:\Windows\...\ScreenConnect.Core.dll, PE32 49->73 dropped 83 4 other malicious files 49->83 dropped 99 newjmendeals.abrdns.com 147.124.211.40, 443, 49746, 49748 MAJESTIC-HOSTING-01-MajesticHostingSolutionsLLCUS United States 51->99 75 C:\Windows\Temp\AdobeDC.msi, Composite 51->75 dropped 125 Creates files in the system32 config directory 51->125 127 Powershell connects to network 51->127 53 msiexec.exe 51->53         started        file13 signatures14 process15
Score:
95%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
Verdict:
inconclusive
YARA:
12 match(es)
Tags:
.Net CAB:COMPRESSION:LZX CAB:COMPRESSION:NONE Executable Html Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.00 SOS: 0.07 SOS: 0.21 SOS: 0.24 SOS: 0.25 SOS: 0.27 SOS: 0.28 SOS: 0.31 SOS: 0.32 SOS: 0.36 SOS: 0.39 Win 32 Exe x86
Link:
https://app.malva.re/file/0f01f5e2886a4be432d5a4f9fd1f93bb
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d/
Threat name:
Win32.Trojan.Sonbokli
Create hunting rule
Status:
Malicious
First seen:
2026-11-10 15:20:31 UTC
File Type:
PE (Exe)
Extracted files:
16
AV detection:
5 of 36 (13.89%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=n2am6doaxqx7xoblewbenkw22rbvnx6dwf7vjjyjdnwqmdxebeoq._file
Verdict:
malicious
Label(s):
ADMINTOOL_ScreenConnect
Create hunting rule
Link:
https://reports.threatray.com/64830d4f-c1c7-4a44-9758-26bc20a72da8
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor discovery execution persistence privilege_escalation ransomware rat revoked_codesign
Link:
https://tria.ge/reports/261111-ayke6as14j/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Boot or Logon Autostart Execution: Authentication Package
Checks computer location settings
Drops file in System32 directory
Event Triggered Execution: Component Object Model Hijacking
Enumerates connected drives
ConnectWise ScreenConnect remote access tool
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Sets service image path in registry
Signed with revoked ConnectWise certificate
Malware Family:
n/a
Verdict:
Suspicious
Tags:
n/a
YARA:
ConventionEngine_Keyword_Install ConventionEngine_Anomaly_MultiPDB_Quintuple_Plus ConventionEngine_Term_Users WMI_strings UNPROTECT_disable_process win_hook
Link:
https://app.threat.zone/submission/dab3e4bf-d6ed-4dd4-ba61-535ce2951f4b
Malware Family:
connectwise
Create hunting rule
Malicious:
True
Tags:
signed exe file-overlay persistence wmi-activity obfuscated adapter-discovery debug-check exec-delay
Link:
https://intel.virussign.com/intelligence/file/6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
Unpacked files
SH256 hash:
6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
MD5 hash:
0f01f5e2886a4be432d5a4f9fd1f93bb
SHA1 hash:
f7942088103a877441839f4bca791243c9953a81
Detections:
INDICATOR_EXE_DotNET_Encrypted
Create hunting rule
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
8a55c15cc76e31042e17458c479772aa95bc1b908016c85b1dc8b8e3eff23254
MD5 hash:
decb1fd20d75e6eade9289cc24605f29
SHA1 hash:
5169602d641c4f2ebd9ca0639622949e00c25566
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
022f96454821f8d974974e33ff2630e6c39c98b20e03f2638c5f712906b9bd48
MD5 hash:
97815b0014438d0d7947675fb3ddc9de
SHA1 hash:
c39851d5b8a4af43c82ac12ecfb51a570b42bb96
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
6de7ff9bd32ceb79232ed76849225283d46aabd07cbc3bc52ca76912b4d807e4
MD5 hash:
90e46fd69c0fcbd484e305ec72ac4142
SHA1 hash:
2d20f58659adf829190ec4b54d55dfb0567d26fe
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
853ad96a513388008140c5e446033184066e0c35301f4779f4caaf781b882a6a
MD5 hash:
b68db8a3bd748e9c64ab464907cbf217
SHA1 hash:
0221cf1af30c2bda8249b9765356effd1dc0894f
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
b927c1c3ce76613153782b3bee3b4b16499b1dd49abb80403cf9b0fb8eb47d2a
MD5 hash:
a680beba45594b10dcbaa1df20e3e99f
SHA1 hash:
3f6f2f26411441e5dd6fd98c8cb758754ff6450b
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
Parent samples :
add978d57fe7c33ff7b6a393a62adf20d33d2b54ea937aa7fe2cfabfd8eb73fb
6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
SH256 hash:
fc4fd565a761c1cbc2ca41c52034067768a1f550811a7870f7dd5a4e935adcc2
MD5 hash:
8a97b09acdf5dfaa39d45dcb48601089
SHA1 hash:
0f56f698d2081f8d979dfcde3a4b96fdf4147b2e
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
289a4eea79baa4141744e44d60db713e18b5f23322663c63047962f51b467614
MD5 hash:
48979a1a6d3badea8124bce04b1e01a5
SHA1 hash:
06931bd96343ce167eda796112a30ca8d9fa536a
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
a5191e82c924733b8a131d7f479c7b7e11755e3e6e996b325f9c0758c0587f33
MD5 hash:
1ca2fb835928ee9bb06230bf0318b3f9
SHA1 hash:
0ac33b4415746ba3a237a9c39649d2cf414b20f5
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
SUSP_NET_Shellcode_Loader_Indicators_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
Parent samples :
add978d57fe7c33ff7b6a393a62adf20d33d2b54ea937aa7fe2cfabfd8eb73fb
6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
SH256 hash:
11d45353da749c175b3f31d1ddc0480d83196d5115323da829ae4e693b287380
MD5 hash:
081381ac3857b86e216b38ea2d10dd55
SHA1 hash:
450bc8fe3c6aac1a27ed5172f0ec1d0cd1670fb8
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
3d15e680ca51b0918fd96a8e045cc36cdcb01d8c2be8448712839ac574813db5
MD5 hash:
d02927f1624828e1312cdf01ddb6839f
SHA1 hash:
547748c8707887148362372be2f3aa0859e592c0
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
6afe637eb24c33b9fe50c72ac762354801062a66796a23107875dd610194b3e2
MD5 hash:
f13b536acff96e17f418f4f2a4ac1a81
SHA1 hash:
79bcb9a217b86e0386d53a79de0508f36999f02a
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
Parent samples :
add978d57fe7c33ff7b6a393a62adf20d33d2b54ea937aa7fe2cfabfd8eb73fb
6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
SH256 hash:
19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc
MD5 hash:
5fb6074b08ac4709cf2f29fa5b49023e
SHA1 hash:
8bbb78a47c08867c50572f0bd2a27171f91e0454
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
ad6062215032ab58369403b1221562b5e7fb5ae7d52b29b7fad69eefb2d8455b
MD5 hash:
723f2aaeeda1d2bb2f49322da349ffc9
SHA1 hash:
ac6ab994beaff69adf8a2dc480a8a628175ff6c8
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
27f353041637adcdb1e73ccf895ec1b09bdca8ad392e00e56147a0a724ee345a
MD5 hash:
1dd976925b80e79060bf59729955a75c
SHA1 hash:
beb8f96c491f673540ae00062157f37d3c05067e
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
Parent samples :
add978d57fe7c33ff7b6a393a62adf20d33d2b54ea937aa7fe2cfabfd8eb73fb
6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
SH256 hash:
9342c7be8036a5f8dc3895d75e3314dce961fd3bc70ee59928c67fa04f0c7e08
MD5 hash:
5419ff27205d3e5affa3fc18b811b843
SHA1 hash:
cf49072c50456381cd26cd32cb97606c5f5cfd26
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
SH256 hash:
6020732afa98fa81df09c4ceb68894ba93cb355af8d7f79224daa3500c70613f
MD5 hash:
e9fb18425160734a618364eb9af288ee
SHA1 hash:
e0b862db4ac4680f62cdabaf95ff037a8e11995a
Link:
https://www.unpac.me/results/039ca6c8-ecc3-4829-9ded-a417faa28fd3/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:exploit_any_poppopret
Create hunting rule
Author:Jeff White [karttoon@gmail.com] @noottrak
Description:Identify POP -> POP -> RET opcodes for quick ROP Gadget creation in target binaries.
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_DotNET_Encrypted
Create hunting rule
Author:ditekSHen
Description:Detects encrypted or obfuscated .NET executables
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
Rule name:Malware_PE_NET_KoiLoader
Create hunting rule
Author:Serhii Kocherhan
Description:Detects Koi Loader .NET executables packed with Confuser featuring specific mutex, assembly metadata, and unmanaged DLL imports
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:TigerRAT_pe_yaraify
Create hunting rule
Author:hunts-yara-code
Description:YARAify-tightened byte rule from 9 sample(s) -- VERIFY hits
Rule name:WIN_Malware_ACRStealer_ForgeAuto_1084c837_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects ACRStealer (pe, etat extrait)
Rule name:WIN_Malware_SalatStealer_ForgeAuto_542e717b
Create hunting rule
Author:Marjoriefort
Description:Detects SalatStealer (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_1762e598_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_2ffc3572
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_37b4704b
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_43faefd2
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_5001c94c
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_74566f98
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_79234c04
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_7e8e91c4
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_92a28498
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_ce8c5b46
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_Unknown_ForgeAuto_e596237b_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat extrait)
Rule name:WIN_Malware_Unknown_ForgeAuto_f1079127
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (pe, etat binaire)
Rule name:WIN_Malware_XWorm_ForgeAuto_6b06c990_Extrait
Create hunting rule
Author:Marjoriefort
Description:Detects XWorm (pe, etat extrait)
Rule name:WIN_Sample_Unique_69354b41
Create hunting rule
Author:Marjoriefort
Description:Specimen unique (soumission Bazaar) - strings distinctifs propres au sample
Reference:69354b41e10daf03d3f3af881b32d5c0fec56b1cfe96629fd4c5263413a42854.exe

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ConnectWise

Executable exe 6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/99285/

Comments