MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 aa0d5f98bb9ef620d8ade9669e88def0a2833158e19ebb7eae8b5bfb23f7ea17. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 9

Intelligence 9 IOCs YARA 7 File information Comments

SHA256 hash:	aa0d5f98bb9ef620d8ade9669e88def0a2833158e19ebb7eae8b5bfb23f7ea17
SHA3-384 hash:	e3e001a4272c41fe9ba8264df817fdfc4b68bb0bc280c2a76b144c7dcbf09257e2a80ab02b785634edcf06bd9eb43a80
SHA1 hash:	92b33dca0faa799704ac15af5d2058d29918512c
MD5 hash:	94d5edd26d79cd617b12f157917b708b
humanhash:	moon-seven-west-paris
File name:	ScreenConnect.ClientSetup.msi
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	13'352'960 bytes
First seen:	2025-11-25 20:12:50 UTC
Last seen:	Never
File type:	msi
MIME type:	application/x-msi
ssdeep	196608:yWh0cGwAWh0cGZWh0cGhWh0cGoWh0cGOWh0cGFWh0cGr:yWac+WacoWac6WacTWacnWac6WacG
Threatray	1'015 similar samples on MalwareBazaar
TLSH	T1E2D6232523FD405AF8F74B79FD3682A45D72BE68CF21C11E9228B90D2A74D4096727B3
TrID	80.0% (.MSI) Microsoft Windows Installer (454500/1/170) 10.7% (.MST) Windows SDK Setup Transform script (61000/1/5) 7.8% (.MSP) Windows Installer Patch (44509/10/5) 1.4% (.) Generic OLE2 / Multistream Compound (8000/1)
Magika	msi
Reporter	juroots
Tags:	ConnectWise msi

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/41492/

Verdict:

Malicious

Score:

70%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69260de35d7fac83ebf2f7dc

Tags:

shellcode

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug base64 expand expired-cert installer installer lolbin packed rundll32

Link:

https://www.filescan.io/uploads/69260de2af4aba3912d47265/reports/9fce9238-c1ec-442d-800b-5e75f83fc156/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/aa0d5f98bb9ef620d8ade9669e88def0a2833158e19ebb7eae8b5bfb23f7ea17

Result

Verdict:

MALICIOUS

Link:

https://labs.inquest.net/dfi/sha256/aa0d5f98bb9ef620d8ade9669e88def0a2833158e19ebb7eae8b5bfb23f7ea17

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Verdict:

Clean

File Type:

msi

Link:

https://opentip.kaspersky.com/aa0d5f98bb9ef620d8ade9669e88def0a2833158e19ebb7eae8b5bfb23f7ea17/results?tab=lookup

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/aa0d5f98bb9ef620d8ade9669e88def0a2833158e19ebb7eae8b5bfb23f7ea17/

Verdict:

Malicious

Threat:

NetworkReferences.Malware.Generic

Link:

https://tip.neiki.dev/file/aa0d5f98bb9ef620d8ade9669e88def0a2833158e19ebb7eae8b5bfb23f7ea17

Threat name:

ByteCode-MSIL.Trojan.DllHijack

Status:

Suspicious

First seen:

2025-11-25 20:13:26 UTC

File Type:

Binary (Archive)

Extracted files:

174

AV detection:

6 of 24 (25.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=vigv7gf3t33cbwfn5ftj5cg66crigmky4gplw7vornn7wi7x5ilq._file

Verdict:

suspicious

Label(s):

admintool_screenconnect

ConnectWise

3c46671af655e0a0b864208dd7a2ab5cd5a9d1f095c1b2fc0f7882d62ddae275

ConnectWise

64049e058f3414066b1b68f84306ec307670b4e93543888b6e40d8e18b74b718

ConnectWise

64adb568ceb1d4abb36113bde0ca9bffa423be366262f8a4ec75b1e23aef50ad

ConnectWise

a0c8f8770fffd941b3e123023432e275aea210a7ab71a6bce5be890861f054c2

ConnectWise

error

ConnectWise

f28a060cd841574451960ddc5f2a706526597e361b1a7eb86245488aaa431014

ConnectWise

+ 1'005 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

backdoor discovery persistence privilege_escalation ransomware rat revoked_codesign

Link:

https://tria.ge/reports/251125-yzjr1ssjap/

Behaviour

Checks SCSI registry key(s)

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Event Triggered Execution: Installer Packages

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Boot or Logon Autostart Execution: Authentication Package

Drops file in System32 directory

Enumerates connected drives

ConnectWise ScreenConnect remote access tool

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Binary is signed using a ConnectWise certificate revoked for key compromise.

Sets service image path in registry

Verdict:

Suspicious

Tags:

n/a

YARA:

n/a

Link:

https://app.threat.zone/submission/4d299d54-224a-4347-9ec3-74b39b81d9cd

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/aa0d5f98bb9ef620d8ade9669e88def0a2833158e19ebb7eae8b5bfb23f7ea17

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	INDICATOR_RMM_ConnectWise_ScreenConnect Create hunting rule
Author:	ditekSHen
Description:	Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	win_evilconwi_w0 Create hunting rule
Author:	Karsten Hahn @ G DATA CyberDefense
Description:	Settings from app.config that hide the connection of the client. These settings are potentially unwanted