🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 13


Intelligence 13 IOCs YARA 7 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20
SHA3-384 hash: 3322b506e64382a633fc804b6406c52d8540dc2c58880398b4b7b58c362a9815ccadf38775696e82991bd53829abd14b
SHA1 hash: 1899f45c817bf5699b08af5449c8ae4403aee09f
MD5 hash: 664cec99845666ad63eabba413e92d41
humanhash: texas-oven-ten-timing
File name:ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20.bin
Download: download sample
Signature ConnectWise
Create hunting rule
File size:12'054'358 bytes
First seen:2026-11-07 02:44:57 UTC
Last seen:Never
File type:Batch (bat) bat
MIME type:text/x-msdos-batch
ssdeep 49152:TWpsS4Fe/lrTJAAsVIa95v35tHodA50LKB0e4J8eKzXKulM8MleKwVGcKBv/iNyL:2
TLSH T1A4C6233A89466BDF0B1566A561093D026DD827635F41232EEBDC41A138E8670CF7EEFC
Magika batch
Reporter Tuxxin
Tags:bat ConnectWise

Intelligence

File Origin
# of uploads :
1
# of downloads :
37
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/fb9212f2-9eb9-43ab-9cdd-a19c431ff737/
Malware family:
n/a
ID:
1
File name:
https://gmgn-ai-desktop.app/
Verdict:
Malicious activity
Analysis date:
2026-11-06 17:30:08 UTC
Tags:
fakesite phishing qrcode uac-bypass auto screenconnect rdp rmm-tool tool remote websocket rat
Link:
https://app.any.run/tasks/28b48af7-cfb1-488a-a30b-7d8e60130cc3

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Generic-EXE.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6af1bbfa1492c978625a44ba
Tags:
vmdetect rapid
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
fltmc lolbin masquerade msiexec obfuscated powershell
Link:
https://www.filescan.io/uploads/6aeed876de928fcd5a576401/reports/7f5dea73-1e81-4573-b7c3-9a7f5651d2dc/overview
Verdict:
Malicious
Labled as:
BAT/TrojanDropper.Agent
Link:
https://www.hybrid-analysis.com/sample/ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20
Verdict:
Adware
File Type:
unix shell
Link:
https://opentip.kaspersky.com/ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20/results?tab=lookup
Result
Threat name:
ScreenConnect Tool
Create hunting rule
Detection:
malicious
Classification:
evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/2000354
Signature
Bypasses PowerShell execution policy
Creates files in the system32 config directory
Enables network access during safeboot for specific services
Found large BAT file
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Modifies security policies related information
Multi AV Scanner detection for submitted file
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Suspicious powershell command line found
Yara detected EXE embedded in BAT file
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 2000354 Sample: h4Nr90whij.bat Startdate: 07/11/2026 Architecture: WINDOWS Score: 100 97 luegner.top 2->97 99 eip-terr-na.cdp1.digicert.com.akahost.net 2->99 101 Malicious sample detected (through community Yara rule) 2->101 103 Multi AV Scanner detection for submitted file 2->103 105 Found large BAT file 2->105 107 4 other signatures 2->107 9 msiexec.exe 156 151 2->9         started        13 cmd.exe 3 2->13         started        15 svchost.exe 2->15         started        17 4 other processes 2->17 signatures3 process4 dnsIp5 87 C:\Windows\Installer\MSICB07.tmp, PE32+ 9->87 dropped 89 C:\Windows\Installer\MSIC559.tmp, PE32 9->89 dropped 91 C:\Windows\Installer\MSIC3F0.tmp, PE32+ 9->91 dropped 93 37 other files (35 malicious) 9->93 dropped 109 Enables network access during safeboot for specific services 9->109 111 Modifies security policies related information 9->111 20 msiexec.exe 9->20         started        22 msiexec.exe 9->22         started        34 6 other processes 9->34 113 Suspicious powershell command line found 13->113 115 Bypasses PowerShell execution policy 13->115 24 SecondInstaller.exe 13->24         started        27 powershell.exe 8 13->27         started        30 powershell.exe 13->30         started        36 4 other processes 13->36 32 drvinst.exe 15->32         started        95 luegner.top 155.254.99.109, 49718, 8041 HYONIX-HyonixSG United States 17->95 38 3 other processes 17->38 file6 signatures7 process8 file9 40 rundll32.exe 11 20->40         started        43 rundll32.exe 22->43         started        61 C:\Windows\Temp\...\SecondInstaller.exe, PE32 24->61 dropped 45 SecondInstaller.exe 24->45         started        117 Found suspicious powershell code related to unpacking or dynamic code loading 27->117 119 Powershell drops PE file 27->119 63 C:\Users\user\AppData\...\SecondInstaller.exe, PE32 30->63 dropped 65 C:\Windows\System32\...\SETCE2B.tmp, PE32+ 32->65 dropped 67 DocuSignPrintDrive...erFilter.dll (copy), PE32+ 32->67 dropped 47 rundll32.exe 32->47         started        signatures10 process11 file12 69 C:\Windows\...\ScreenConnect.Windows.dll, PE32 40->69 dropped 71 C:\...\ScreenConnect.InstallerActions.dll, PE32 40->71 dropped 73 C:\Windows\...\ScreenConnect.Core.dll, PE32 40->73 dropped 81 4 other malicious files 40->81 dropped 83 2 other malicious files 43->83 dropped 75 C:\Windows\...\Docusign Print Driver x64.exe, PE32 45->75 dropped 77 DocuSign.Bootstrap...ation.resources.dll, PE32 45->77 dropped 79 DocuSign.Bootstrap...ation.resources.dll, PE32 45->79 dropped 85 14 other malicious files 45->85 dropped 50 Docusign Print Driver x64.exe 45->50         started        121 Creates files in the system32 config directory 47->121 signatures13 process14 file15 53 C:\Users\user\AppData\Local\Temp\MSIBE0.tmp, PE32+ 50->53 dropped 55 C:\Users\user\AppData\Local\...\MSI344A.tmp, PE32 50->55 dropped 57 C:\Users\user\AppData\Local\...\MSI14F9.tmp, PE32 50->57 dropped 59 C:\...\Docusign Print Driver x64.exe, PE32 50->59 dropped
Gathering data
Threat name:
Script-BAT.Trojan.Qwexlafiba
Create hunting rule
Status:
Malicious
First seen:
2026-11-06 23:00:21 UTC
File Type:
Text
AV detection:
6 of 24 (25.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=vuewkmuw2wy5ydgmpz7mhwxmtrksjfxxc4334va667eoxfhapyqa._file
Verdict:
malicious
Label(s):
ADMINTOOL_ScreenConnect
Create hunting rule
Link:
https://reports.threatray.com/af57d908-798b-4029-912e-8e98988ea6d4
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware backdoor defense_evasion discovery execution persistence privilege_escalation ransomware rat revoked_codesign spyware trojan
Link:
https://tria.ge/reports/261107-jpxtkaby9n/
Behaviour
Uses Volume Shadow Copy service COM API
Uses Task Scheduler COM API
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
Suspicious use of FindShellTrayWindow
Suspicious use of AdjustPrivilegeToken
Suspicious behavior: EnumeratesProcesses
Runs net.exe
Modifies system certificate store
Modifies registry class
Modifies data under HKEY_USERS
Modifies Internet Explorer settings
Checks processor information in registry
Checks SCSI registry key(s)
Enumerates physical storage devices
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Drops file in System32 directory
Boot or Logon Autostart Execution: Authentication Package
Enumerates connected drives
Command and Scripting Interpreter: PowerShell
Checks installed software on the system
Adds Run key to start application
Loads dropped DLL
Executes dropped EXE
Event Triggered Execution: Component Object Model Hijacking
ConnectWise ScreenConnect remote access tool
Checks computer location settings
Signed with revoked ConnectWise certificate
Sets service image path in registry
Manipulates Digital Signatures
Boot or Logon Autostart Execution: Port Monitors
Malware Family:
connectwise
Create hunting rule
Malicious:
True
Tags:
checks-network-adapters calls-wmi persistence obfuscated bat macro-powershell
Link:
https://intel.virussign.com/intelligence/file/ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ad09653296d5/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb
Rule name:vmdetect
Create hunting rule
Author:nex
Description:Possibly employs anti-virtualization techniques
Rule name:Warp
Create hunting rule
Author:Seth Hardy
Description:Warp
Rule name:WarpStrings
Create hunting rule
Author:Seth Hardy
Description:Warp Identifying Strings

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

ConnectWise

Batch (bat) bat ad09653296d5b1dc0ccc7e7ec3daec9c552496f71737be541ef7c8eb94e07e20

(this sample)

  
Delivery method
Distributed via web download

Comments