MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 5


Intelligence 5 IOCs YARA 2 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662
SHA3-384 hash: 829a3dc56e35b33cc7a306ffab9a32ea42381184908df7df7b69bdf14b5a67a5bc36515e230f4fb10c281ef0cbb4eb70
SHA1 hash: fe15e77e0aef283ced5afe77b8aecadc27fc86cf
MD5 hash: 665a8c1e8ba78f0953bc87f0521905cc
humanhash: chicken-chicken-march-beryllium
File name:SecuriteInfo.com.Heur.14298.9801
Download: download sample
Signature ConnectWise
Create hunting rule
File size:549'888 bytes
First seen:2025-03-14 14:42:41 UTC
Last seen:2025-03-14 16:27:19 UTC
File type:DLL dll
MIME type:application/x-dosexec
imphash dae02f32a21e03ce65412f6e56942daa (123 x YellowCockatoo, 60 x CobaltStrike, 44 x JanelaRAT)
ssdeep 6144:JL2DLhOnlTQatfpw7TkJ9/KeZBFR/Zw7VTcWt5jv8jyEzR39GBCquqwMSRq/sreR:JLMhOeM52aBFcTbkdpRL6Ei
TLSH T10EC46D037398EB3BEDAF573EA43151C94670EC01295AE76F1ED4D8E61E823864F442E6
TrID 65.9% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
12.0% (.EXE) Win64 Executable (generic) (10522/11/4)
7.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
5.1% (.EXE) Win32 Executable (generic) (4504/4/1)
2.3% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter SecuriteInfoCom
Tags:ConnectWise dll

Intelligence

File Origin
# of uploads :
3
# of downloads :
422
Origin country :
FR FR
Vendor Threat Intelligence
Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=67d4690f08116ce425713025
Tags:
connectwise
Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Verdict:
Unknown
Threat level:
  2.5/10
Confidence:
100%
Tags:
obfuscated reconnaissance
Link:
https://www.filescan.io/uploads/67d4408801edd28374afe715/reports/649c9315-b9cd-4fed-84fc-761545fd9eb5/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662
Result
Verdict:
UNKNOWN
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/06fa1294-e6d8-42ac-929d-07ae9dbff382
Result
Threat name:
n/a
Detection:
clean
Classification:
n/a
Score:
3 / 100
Link:
https://www.joesandbox.com/analysis/1638642
Behaviour
Behavior Graph:
n/a
Score:
0%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662/
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=qn32q5rfybgklvirz3wjdogafh4zaedzvp3cz4u46ejuzgp2ezra._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
n/a
Link:
https://tria.ge/reports/250314-r3lx8awkw2/
Unpacked files
SH256 hash:
8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662
MD5 hash:
665a8c1e8ba78f0953bc87f0521905cc
SHA1 hash:
fe15e77e0aef283ced5afe77b8aecadc27fc86cf
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/d1e4bce5-ccc3-4a4e-bfbe-a24a77d68c93/
Parent samples :
006930b41d4187f382d805989c3f1cc709d626d36a9bb1d6eacd45887c78e815
55a2d2db3cd1b2906f2d5440abdcc758bc5e30ca6343b8492df4c011095666df
56b540efa56fb641d8f5c9705197422bea0259ef5e0517661797d76fe3786b4a
29ada66e00b3836081159768d9ce4e28bae93259227af22ee8052fa0485df9da
0914dbeb1da7d1b16d4886fb2c21109c992bed6dd198caf75984f462ea73c968
8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662
1aacc95ca027a01f95496bd89b6d230cfdb319d6efaab93652afa5334daa5cbd
33b2b67b33d1e021d63c507a98bc2cd73c9f888ee81fb9473ede1926992c3a1d
b5f94ce781cca1b6e47491ee86ccea6a5352f1d18158abb307f47c01b3fde0f0
9de042819c9dc1f30ea1fb3865209d1de3d3b1d90206de34fe4b19df52a0ea68
07b0e46ff641660b9864ee1ca46b2d0744bb2493a5d98824050a3b7ca5299350
5ce2b3a958e3c2f0e1d71cfcd553474a126d146d67909c2eb4d11244e789cbf7
67b0c562eb5b9122da536ea86dee4fdb897cd903c4db5cd7902a6c063fc31e6d
0719453ecc8382af1e151b86d483f1c5dc4c49dd860e59125bb1f0cc53851133
e2fb1f47ad7b8eed0d45af953e6fbb93c4171a92267becfc05e88bc189746ea8
929dc73f49dcb6f03b9de070f90b1243f0536e40c2275a9f41faf0b221d5a6ae
2318850b2f87746e8af7fb74578e21fd0ea620c100cad1555074cc26a5ffba7f
ba006900a64d146a3eb87542a8210b3ec2021b3d736f42902c2ed6db71c440d1
c02dc41e95f8b3493cf0643ee99fcf918bcda28e667ad8315dbeeaab73fdf468
1611d11cb2d49a96af4cba5b510ee9e6b72bc0a7fa2c8c380ffaff2221617a72
be6d79a5aa6d5f5d5c0bf12acf9052c3ee7657399c019da250fc860c0ccef911
a4d935e13ad2b0519afe895b7c4348b6610dd90d971e30ac6e553f8e39890811
a4880a2d4ccebee86a3c520a0d6a5671fcd96676277e00391f04d53866e61838
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8377a87625c04ca5d511ceec91b8c029f9901079abf62cf29cf1134c99fa2662

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:extracted_at_0x44b
Create hunting rule
Author:cb
Description:sample - file extracted_at_0x44b.exe
Reference:Internal Research
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory

File information

The table below shows additional information about this malware sample such as delivery method and external references.

BLint

The following table provides more information about this file using BLint. BLint is a Binary Linter to check the security properties, and capabilities in executables.

Findings
IDTitleSeverity
CHECK_AUTHENTICODEMissing Authenticodehigh
CHECK_DLL_CHARACTERISTICSMissing dll Security Characteristics (HIGH_ENTROPY_VA)high

Comments