MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 96144a4b38ac3b83fb802b46ab2223c1c61121bd8b8e407b7bd00e503ea05dba. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

33

Origin country :

US

Vendor Threat Intelligence

ACCE

Gathering data

CyberFortress Malicious

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69cd1f736363ca5d27f092f3

Tags:

connectwise xtreme overt sage

Hybrid Analysis Unknown

Verdict:

Suspicious

Link:

https://www.hybrid-analysis.com/sample/96144a4b38ac3b83fb802b46ab2223c1c61121bd8b8e407b7bd00e503ea05dba

Kaspersky OpenTIP Clean

Verdict:

Clean

File Type:

wsf

First seen:

2026-04-01T23:51:00Z UTC

Last seen:

2026-04-02T00:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/96144a4b38ac3b83fb802b46ab2223c1c61121bd8b8e407b7bd00e503ea05dba/results?tab=lookup

Nucleon Malprob Benign

Score:

0%

Verdict:

Benign

File Type:

SCRIPT

Link:

https://malprob.io/report/96144a4b38ac3b83fb802b46ab2223c1c61121bd8b8e407b7bd00e503ea05dba

Malva.RE Malware

Verdict:

Malware

YARA:

4 match(es)

Tags:

DeObfuscated Html Obfuscated Shell.Application T1059.005 VBScript WSF File

Link:

https://app.malva.re/file/41111f90b465903c7bd2c3d9c99efef6

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/96144a4b38ac3b83fb802b46ab2223c1c61121bd8b8e407b7bd00e503ea05dba/

Neiki Susipicious

Verdict:

Susipicious

Link:

https://tip.neiki.dev/file/96144a4b38ac3b83fb802b46ab2223c1c61121bd8b8e407b7bd00e503ea05dba

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sykeuszyvq5yh64afndkwirdyhdbcin5rohea6332ahfapvalw5a._file

Threatray admintool_screenconnect

Verdict:

malicious

Label(s):

admintool_screenconnect

Alert

Create hunting rule

Similar samples:

039359cb8c082a4fe2c867b1bb6ed159615ed4cfaf4e6532ddbdd16bf53ebfe8

29dac2d3b58b2c7ac6d872d68a3d71fdb4b78b1f9420738e107006087457df71

9bb8e7b466dd8e068dee78cb714c1061c198698442c259b02aaf94b07aeed714

c0ca7788e9fc8e7f59059aa53f9a0ee460f0c4b99308b8213a2fc3439b49467d

ddaba68dfac28852d3936c8ca86b9061d754e02bd20c15ab36504805f634b0be

error

f71e8c66a51b05bb87941d2ab45dde1b83d97c32bd6443b80d04e8df6e419d11

f7db0fb97ee95b9f4a6175c66496bad6bed4ed5b0c2ad73c2ce27013e17b9dad

+ 1'828 additional samples on MalwareBazaar

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

backdoor discovery execution persistence privilege_escalation rat revoked_codesign

Link:

https://tria.ge/reports/260401-qwjnvacz4l/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Boot or Logon Autostart Execution: Authentication Package

Drops file in System32 directory

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Checks computer location settings

ConnectWise ScreenConnect remote access tool

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Sets service image path in registry

Signed with revoked ConnectWise certificate

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Malicious File

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/96144a4b38ac3b83fb802b46ab2223c1c61121bd8b8e407b7bd00e503ea05dba