🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 72f1a91566f9a644b5795e23caa003780a4869fa903607fbe705382c19c545af. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 10


Intelligence 10 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 72f1a91566f9a644b5795e23caa003780a4869fa903607fbe705382c19c545af
SHA3-384 hash: b211ad5fbc9144e4132ae4b5590c60d426c7678e118cfcd83c41dc6c17913552ff24af262cb028a1428fe8b8469c47de
SHA1 hash: 71bdc656e3b615abb31a5084170aeb7891e1ec6d
MD5 hash: 674644c5e8e89fbd13b1e85631222b92
humanhash: fanta-nuts-minnesota-saturn
File name:Acrobat_Set-Up_7474.vbs
Download: download sample
Signature ConnectWise
Create hunting rule
File size:3'429 bytes
First seen:2026-10-22 04:16:14 UTC
Last seen:Never
File type:Visual Basic Script (vbs) vbs
MIME type:text/plain
ssdeep 96:NGaSGf5r2cZlfwG8EstCg1/TAnIf2N/X6TG0iW:0aZtHfaPCCeIf2mG0T
TLSH T12C61510F7C4B41A2DC79C1078B1A3A5FCAC3166B161000B9FABC94492F3166FC6F91A7
Magika vba
Reporter abuse_ch
Tags:ConnectWise vbs

Intelligence

File Origin
# of uploads :
1
# of downloads :
97
Origin country :
SE SE
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/93897/
Verdict:
Malicious
Score:
81.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ad98e67afb06e650cd88680
Tags:
obfuscate xtreme shell
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive expand lolbin lolbin msiexec powershell rundll32 wscript
Link:
https://www.filescan.io/uploads/6ad98e2d06fc2e42632ccbb0/reports/3354946f-f2e3-4cf4-8932-a8cdd9a7ccc6/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/72f1a91566f9a644b5795e23caa003780a4869fa903607fbe705382c19c545af
Verdict:
Malicious
File Type:
vbs
First seen:
2026-10-21T21:11:00Z UTC
Last seen:
2026-10-24T02:06:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/72f1a91566f9a644b5795e23caa003780a4869fa903607fbe705382c19c545af/results?tab=lookup
Result
Threat name:
ScreenConnect Tool
Create hunting rule
Detection:
malicious
Classification:
expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1990369
Signature
Contains functionality to hide user accounts
Enables network access during safeboot for specific services
Modifies security policies related information
Potential malicious VBS script found (suspicious strings)
Powershell connects to network
Sigma detected: Suspicious Invoke-WebRequest Execution
Sigma detected: WScript or CScript Dropper
Suricata IDS alerts for network traffic
Suspicious execution chain found
Suspicious powershell command line found
VBScript performs obfuscated calls to suspicious functions
Windows Scripting host queries suspicious COM object (likely to drop second stage)
WScript reads language and country specific registry keys (likely country aware script)
Wscript starts Powershell (via cmd or directly)
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1990369 Sample: Acrobat_Set-Up_7474.vbs Startdate: 22/10/2026 Architecture: WINDOWS Score: 100 61 blog.tranktechies.com 2->61 69 Suricata IDS alerts for network traffic 2->69 71 Potential malicious VBS script found (suspicious strings) 2->71 73 Contains functionality to hide user accounts 2->73 75 2 other signatures 2->75 9 wscript.exe 1 2->9         started        12 msiexec.exe 94 49 2->12         started        15 ScreenConnect.ClientService.exe 17 2 2->15         started        17 svchost.exe 2->17 injected signatures3 process4 file5 85 VBScript performs obfuscated calls to suspicious functions 9->85 87 Suspicious powershell command line found 9->87 89 Wscript starts Powershell (via cmd or directly) 9->89 95 3 other signatures 9->95 19 wscript.exe 2 9->19         started        41 C:\Windows\Installer\MSIF360.tmp, PE32 12->41 dropped 43 C:\Windows\Installer\MSIF14B.tmp, PE32 12->43 dropped 45 C:\...\ScreenConnect.WindowsFileManager.exe, PE32 12->45 dropped 47 9 other files (none is malicious) 12->47 dropped 91 Enables network access during safeboot for specific services 12->91 93 Modifies security policies related information 12->93 22 msiexec.exe 12->22         started        24 msiexec.exe 1 12->24         started        26 msiexec.exe 12->26         started        28 ScreenConnect.WindowsClient.exe 15->28         started        signatures6 process7 signatures8 77 Suspicious powershell command line found 19->77 79 Wscript starts Powershell (via cmd or directly) 19->79 81 WScript reads language and country specific registry keys (likely country aware script) 19->81 30 powershell.exe 14 17 19->30         started        35 msiexec.exe 6 19->35         started        37 rundll32.exe 11 22->37         started        83 Contains functionality to hide user accounts 28->83 process9 dnsIp10 63 blog.tranktechies.com 23.235.204.196, 443, 49723 IMH-IAD-InMotionHostingIncUS United States 30->63 49 C:\Users\user\Desktop\...\dual_installer.msi, Composite 30->49 dropped 65 Powershell connects to network 30->65 39 conhost.exe 30->39         started        51 C:\Users\user\AppData\Local\...\MSIE65E.tmp, PE32 35->51 dropped 53 C:\Users\user\...\ScreenConnect.Windows.dll, PE32 37->53 dropped 55 C:\...\ScreenConnect.InstallerActions.dll, PE32 37->55 dropped 57 C:\Users\user\...\ScreenConnect.Core.dll, PE32 37->57 dropped 59 4 other files (none is malicious) 37->59 dropped 67 Contains functionality to hide user accounts 37->67 file11 signatures12 process13
Score:
10%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/72f1a91566f9a644b5795e23caa003780a4869fa903607fbe705382c19c545af
Verdict:
Malware
YARA:
1 match(es)
Tags:
Batch Command COM Behavior Trace DeObfuscated Obfuscated PowerShell PowerShell Call Scripting.FileSystemObject Shell.Application SOS: 0.46 T1027 T1059 T1059.001 T1059.005 T1105 VBScript WScript.Shell
Link:
https://app.malva.re/file/674644c5e8e89fbd13b1e85631222b92
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/72f1a91566f9a644b5795e23caa003780a4869fa903607fbe705382c19c545af/
Threat name:
Script.Trojan.Heuristic
Create hunting rule
Status:
Malicious
First seen:
2026-10-22 01:00:05 UTC
File Type:
Text (VBS)
AV detection:
5 of 24 (20.83%)
Threat level:
  2/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=oly2sflg7gtejnlzlyr4viadpafeq2p2sa3ap67hau4cygofiwxq._file
Verdict:
malicious
Label(s):
ADMINTOOL_ScreenConnect
Create hunting rule
Link:
https://reports.threatray.com/c3e75c0f-5a75-460a-8b5c-dbd0c178a1ff
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor discovery execution persistence privilege_escalation ransomware rat revoked_codesign
Link:
https://tria.ge/reports/261022-e2bdwahy5v/
Behaviour
Checks SCSI registry key(s)
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Boot or Logon Autostart Execution: Authentication Package
Executes a VBScript file via the Windows Script Host.
Enumerates connected drives
Checks computer location settings
ConnectWise ScreenConnect remote access tool
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Sets service image path in registry
Signed with revoked ConnectWise certificate
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/72f1a91566f9a644b5795e23caa003780a4869fa903607fbe705382c19c545af

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:SUSP_Script_PowerShell_Hidden_Launcher
Create hunting rule
Author:Marjoriefort
Description:Script (JS/VBS) lancant PowerShell en mode furtif - dropper frais MalwareBazaar
Reference:Veille fraicheur 2026-09-14 / cluster misses web
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/93897/

Comments