MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 14

Intelligence 14 IOCs YARA 15 File information Comments

SHA256 hash:	92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c
SHA3-384 hash:	a84ae75b625ca341dacf1bc9ead1d2f4a95513fab3be42f483d2335acce2c6a405657eb1f399e9c112a1650fad463af0
SHA1 hash:	de4f36ed82b908c9318b1c1237c899baf27e8b32
MD5 hash:	18767665e820b4986f5e81ddf596473e
humanhash:	maryland-bakerloo-nine-don
File name:	ScreenConnect.ClientSetup.exe
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	5'673'728 bytes
First seen:	2026-05-30 17:55:14 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9771ee6344923fa220489ab01239bdfd (459 x ConnectWise)
ssdeep	98304:pz3us6efPcIdoaxcp8wy5c3trGflkQ5DUOgJ9zlEy:pCfefPlHxcp9ym3WltDUJV6y
TLSH	T1F546E101B3D695B6D1BF0638D87A56656734BC049712CBBF5394BD392E32BC08E323A6
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	BlinkzSec
Tags:	ConnectWise signed

Code Signing Certificate

Organisation:	Любое название
Issuer:	Любое название Root
Algorithm:	sha256WithRSAEncryption
Valid from:	2023-04-01T00:00:00Z
Valid to:	2038-01-01T00:00:00Z
Serial number:	01
Intelligence:	450 malware samples on MalwareBazaar are signed with this code signing certificate
Cert Graveyard Blocklist:	This certificate is on the Cert Graveyard blocklist
Thumbprint Algorithm:	SHA256
Thumbprint:	6a0726f610f16ea4edd05c0150e06b0644afc3b8cd321457e2c6a3577652a1da
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

_92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c.exe

Verdict:

Malicious activity

Analysis date:

2026-05-30 17:56:19 UTC

Tags:

screenconnect tool rmm-tool remote

Link:

https://app.any.run/tasks/e4ba70d5-a559-48ef-b175-3e47f616ebbd

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/68551/

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a1b24a1a22676d7bfe4350f

Tags:

connectwise shellcode dropper crypted

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Launching a process

Creating a file

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Loading a suspicious library

Modifying a system file

Launching a service

Creating a file in the Windows subdirectories

Creating a file in the Program Files subdirectories

Changing a file

Enabling autorun with the shell\open\command registry branches

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug base64 expired-cert invalid-signature microsoft_visual_cc overlay packed packed privilege reconnaissance signed

Link:

https://www.filescan.io/uploads/6a1b24fdf144207b845f9959/reports/58ad44ba-0d0e-47ae-9a71-5eceeaedef26/overview

Verdict:

Malicious

Labled as:

RiskWare[RemoteAdmin]/MSIL.ConnectWise

Link:

https://www.hybrid-analysis.com/sample/92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-05-30T15:28:00Z UTC

Last seen:

2026-05-31T22:33:00Z UTC

Hits:

~10

Detections:

BSS:Trojan.Win32.Generic.nblk BSS:HackTool.Win32.Yzon.a BSS:Trojan.Win32.Generic not-a-virus:RemoteAdmin.MSIL.ConnectWise.d not-a-virus:RemoteAdmin.MSIL.ConnectWise.a not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen not-a-virus:RemoteAdmin.MSIL.ConnectWise.c not-a-virus:RemoteAdmin.MSIL.ConnectWise.b not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen UDS:DangerousObject.Multi.Generic

Link:

https://opentip.kaspersky.com/92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c/results?tab=lookup

Malware family:

ConnectWise Inc

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/d00dae74-f4da-4d60-97f7-842abc64dd94

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c/

Threat name:

Win32.Trojan.Qwexlafiba

Status:

Malicious

First seen:

2026-05-30 17:51:27 UTC

File Type:

PE (Exe)

Extracted files:

174

AV detection:

25 of 38 (65.79%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sklfx6s7irwfpt6gltuntfk6x2c56nl6l6vp5amdcv4k3krprz6a._file

Verdict:

suspicious

Label(s):

admintool_screenconnect

Similar samples:

error

ConnectWise

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery ransomware revoked_codesign

Link:

https://tria.ge/reports/260530-whqswscv8j/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Badlisted process makes network request

Enumerates connected drives

Checks computer location settings

Loads dropped DLL

Signed with revoked ConnectWise certificate

Unpacked files

SH256 hash:

92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c

MD5 hash:

18767665e820b4986f5e81ddf596473e

SHA1 hash:

de4f36ed82b908c9318b1c1237c899baf27e8b32

Detections:

win_evilconwi_w0

triage_screenconnect_rat

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

8a55c15cc76e31042e17458c479772aa95bc1b908016c85b1dc8b8e3eff23254

MD5 hash:

decb1fd20d75e6eade9289cc24605f29

SHA1 hash:

5169602d641c4f2ebd9ca0639622949e00c25566

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

289a4eea79baa4141744e44d60db713e18b5f23322663c63047962f51b467614

MD5 hash:

48979a1a6d3badea8124bce04b1e01a5

SHA1 hash:

06931bd96343ce167eda796112a30ca8d9fa536a

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

319057c4014ab57060502eea0ace88606c52da7718f93eebdcf4120092403b02

MD5 hash:

a20da0875ac3c91eac5bb8af4696e3cf

SHA1 hash:

17f4b173176dad483f11684b7d199be36c3c46f3

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

c79fa719fd2e4baddb1f7a05f7861faa0a14f6be0ef8715c5364240c8537e0d4

MD5 hash:

aff68f3477a4f4b0aeabc3e44862b132

SHA1 hash:

52c7da359816dad646579ee8458b382c35c5b32d

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

fb65d55463fce0c42c2b0d0d4d99c1d3d4cfb264800363b95be390977c690ee3

MD5 hash:

45474626f986d8c1b55fe6f33209dcff

SHA1 hash:

824bac6eb5bcd869137a83d9334f675cd6eaab11

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc

MD5 hash:

5fb6074b08ac4709cf2f29fa5b49023e

SHA1 hash:

8bbb78a47c08867c50572f0bd2a27171f91e0454

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

ad6062215032ab58369403b1221562b5e7fb5ae7d52b29b7fad69eefb2d8455b

MD5 hash:

723f2aaeeda1d2bb2f49322da349ffc9

SHA1 hash:

ac6ab994beaff69adf8a2dc480a8a628175ff6c8

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

1178ea9cb71451a4e5806aafc266a077c129d28940748fa1823db7803e66d442

MD5 hash:

753f5cdd7ada175e421f55f114c1e948

SHA1 hash:

b687d5d818aa2698b7605089047324b9bd690eb3

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

c21b341e9350038c8b1b875e848c694184cfa88d9570e6fd92f4448ad27bcf5c

MD5 hash:

5d404271c57ff9aae64b77515e573bdf

SHA1 hash:

bdeab92d1d16528d92a936a6d7051e679c5f2ac0

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

9342c7be8036a5f8dc3895d75e3314dce961fd3bc70ee59928c67fa04f0c7e08

MD5 hash:

5419ff27205d3e5affa3fc18b811b843

SHA1 hash:

cf49072c50456381cd26cd32cb97606c5f5cfd26

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

SH256 hash:

2b3a903e3f879b7ce7428bc4a68766d5ca80c813d31590451d041335dabcce83

MD5 hash:

4cc33b476bc5f47ade447a4082984ef6

SHA1 hash:

d48bc03127e3b9023de6ef9f2ac01f05b066407f

Link:

https://www.unpac.me/results/ff2953b5-2bae-40a4-9928-c32bdc8302ab/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/92965bfa5f446c57cfc65ce8d9955ebe85df357e5faafe81831578adaa2f8e7c

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_EXE_DotNET_Encrypted Create hunting rule
Author:	ditekSHen
Description:	Detects encrypted or obfuscated .NET executables

Rule name:	INDICATOR_RMM_ConnectWise_ScreenConnect Create hunting rule
Author:	ditekSHen
Description:	Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory

Rule name:	INDICATOR_RMM_ConnectWise_ScreenConnect_CERT Create hunting rule
Author:	ditekSHen
Description:	Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	win_evilconwi_w0 Create hunting rule
Author:	Karsten Hahn @ G DATA CyberDefense
Description:	Settings from app.config that hide the connection of the client. These settings are potentially unwanted