MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 14


Intelligence 14 IOCs YARA 12 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
SHA3-384 hash: cab90d893b118d4a089ff4f9f0d6eaaad99e73e202ebda3e48696c2b16c78f980fdce3c346ccc0936ffd4038b131ab0c
SHA1 hash: c7d61f79297d3469538569176f3d6b256bcb52f5
MD5 hash: e4419edd98580f110a98660c4f89547b
humanhash: tango-wyoming-double-carolina
File name:ScreenConnect.ClientSetup.exe
Download: download sample
Signature ConnectWise
Create hunting rule
File size:12'580'920 bytes
First seen:2026-02-17 20:56:56 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 9771ee6344923fa220489ab01239bdfd (271 x ConnectWise)
ssdeep 196608:p1EfefPkWKaLNkbgFi4Q0KaLNkbgRKaLNkbg/KaLNkbgE:p/WgFiHqWg1WgXWgE
Threatray 1'321 similar samples on MalwareBazaar
TLSH T199C61211B3E585B5E0BF0A38D87A86566A34BC049716C6BF57A4BD292D32FC08E31377
TrID 29.5% (.EXE) Win64 Executable (generic) (6522/11/2)
22.8% (.EXE) Win16 NE executable (generic) (5038/12/1)
20.3% (.EXE) Win32 Executable (generic) (4504/4/1)
9.1% (.EXE) OS/2 Executable (generic) (2029/13)
9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika pebin
Reporter Anonymous
Tags:ConnectWise exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
US US
Vendor Threat Intelligence
Malware configuration found for:
ScreenConnect
Details
ScreenConnect
a c2 socket address, RSA public key
Link:
https://research.acce.ciphertechsolutions.com/results/a9af0f90-193d-4bf2-83ed-983d88c95fa5/
Malware family:
n/a
ID:
1
File name:
ScreenConnect.ClientSetup.exe
Verdict:
Malicious activity
Analysis date:
2026-02-17 21:00:57 UTC
Tags:
screenconnect tool rmm-tool remote rat
Link:
https://app.any.run/tasks/407bdd23-f2b6-467d-a90a-7d3c5413594e

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/53639/
Verdict:
Malicious
Score:
97.4%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6994d6552d369b1ab284de0d
Tags:
connectwise shellcode dropper crypted
Verdict:
Malicious
Labled as:
RemoteAdmin.ConnectWiseControl
Link:
https://www.hybrid-analysis.com/sample/b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
Verdict:
Adware
File Type:
exe x32
Detections:
BSS:Trojan.Win32.Generic BSS:Exploit.Win32.Generic.nblk BSS:Exploit.Win32.Generic not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen
Link:
https://opentip.kaspersky.com/b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3/results?tab=lookup
Malware family:
ConnectWise Inc
Create hunting rule
Verdict:
Suspicious
Link:
https://analyze.intezer.com/analyses/3375b134-8739-4c42-9702-4a41f31dfee7
Score:
99%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3/
Verdict:
Malicious
Threat:
Family.SCREENCONNECT
Link:
https://tip.neiki.dev/file/b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
Threat name:
Win32.Trojan.Znyonm
Create hunting rule
Status:
Malicious
First seen:
2026-02-17 20:44:21 UTC
AV detection:
9 of 38 (23.68%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=wwkx57mkvjdr245wmnafzmlyrh5metlswznkm6af6iy7lclykczq._file
Verdict:
malicious
Label(s):
admintool_screenconnect
Create hunting rule
Similar samples:
29065f6b2ad4d908eacc6dec0b82549a469e13068012b990bcb3f8ed19c94aa5
ConnectWise
29ef0043dfd8c1e642c559976201c44823757eb8cb2dc9c5e9f6183dd9678883
ConnectWise
5be22549da694e3d6493ca85d0eeba5b0903ad6c98a3770427cd2947962b4bc2
ConnectWise
5e6bcaf5c117205bd6e95bc9da38e3c9d384ec281f8efacb8b1671f4a6d3a1d8
ConnectWise
9f9ba57f3c2425d94a2a2d40886d8582ec75b774814d6eeb9f0069f969c5eb25
ConnectWise
b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
ConnectWise
be48b072d698b978b8547d3d8d6901586ec4abb129786cd880d294bd273a5b87
ConnectWise
d4099d9a8b3826e55795c4a0c6b1635ae96849518849e99004716785126854c5
ConnectWise
e9e09b3f618eb1a95b2d9d4928f5c59eec3073f3fafe216e9207b0728a8fd2af
ConnectWise
ead39cfaa2f4c7734f86cff9e7426a9ce2b64161215ba597bff4892ab57d3998
ConnectWise
error
ConnectWise
+ 1'311 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
backdoor discovery persistence privilege_escalation ransomware rat
Link:
https://tria.ge/reports/260217-zrw8tadt4a/
Behaviour
Checks SCSI registry key(s)
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Uses Volume Shadow Copy service COM API
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Executes dropped EXE
Loads dropped DLL
Boot or Logon Autostart Execution: Authentication Package
Checks computer location settings
Drops file in System32 directory
Event Triggered Execution: Component Object Model Hijacking
Badlisted process makes network request
Enumerates connected drives
ConnectWise ScreenConnect remote access tool
Sets service image path in registry
Unpacked files
SH256 hash:
b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
MD5 hash:
e4419edd98580f110a98660c4f89547b
SHA1 hash:
c7d61f79297d3469538569176f3d6b256bcb52f5
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
8a55c15cc76e31042e17458c479772aa95bc1b908016c85b1dc8b8e3eff23254
MD5 hash:
decb1fd20d75e6eade9289cc24605f29
SHA1 hash:
5169602d641c4f2ebd9ca0639622949e00c25566
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
173fc988cdec5381253dbe9a4b3dd0128b7861ac6fc9cfee155c7531f374abc5
MD5 hash:
0d2828c6fee8f13af8fd78dc5a6528ae
SHA1 hash:
983c017540421b6e05d643efc7ec254d7864cdeb
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
9a990a41ea42339ada13c3b7d37bd43abd8dc1febc8162981d36fd702d5e48fa
MD5 hash:
d6b51ff1d61dd0738f03ee8d62babe4b
SHA1 hash:
411f5ed7e3f9f86f9ac4c3173c5577c68ab3ba0d
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
a5c8ede4d24165797dcfbabbb85f62c44a79b058381e68249bf418a01fc67a1d
MD5 hash:
d3a1ed78f416053c859f48c4a1aa8cd2
SHA1 hash:
5d7370476bceb7ac0bf52ef535ecc1022d621136
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
c8102fc3bda354653fc1c80b500de20d1a6bb274826334f76817f595434d2f0d
MD5 hash:
524cfd0704dbd770146594498e9d0fc1
SHA1 hash:
3bc2903ce403fdf7a703374ff26dee4d8fa8e265
Detections:
SUSP_NET_Large_Static_Array_In_Small_File_Jan24
Create hunting rule
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
Parent samples :
cdb28ec4d453c52e96faf710163c4d792ea3bce7583428c6c15daea470a18884
7d524bc00ec1f1adc67f8f729d295456ec327d04135c68e8d543bd3927cea97f
0e6f61869d37ac6506bd1dcb260d0a76d8e5d8ed156d81b786007c435c788016
b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
ac9c912efbed697af7befaef803b15ebd95d29afc2a6cae92886e8a3642afa34
c03be9a117caff7c220bcc199f902b3aec8ab5a1420453122d382d4a8fe7fb61
784bcc73bf933e33d084812f7aea020a47030943f67bb5cc11e1fb0585e40e6d
da981ff73b98d1ab4670f5dcde1e2b956d7acd3ae4af2f6d778ab7cc0ce85701
SH256 hash:
dbaffdb4d49e5dba309f54b1fc110c236042ac82ccde029b2917e189edaf84d3
MD5 hash:
6a4d5935fe62a2af792061e04aa6496c
SHA1 hash:
bd84f040e11adc3c212766856968743f1e6bf99b
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
b65b4fe4aaf1c9de59901d44d1b67556cb2e0038006e2568828e30d8709b877a
MD5 hash:
7e7100b69fcb84e1b49fd31b822b6ecd
SHA1 hash:
0390da53e2b20e9f9d95bf0c31e8e57412c4357f
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
289a4eea79baa4141744e44d60db713e18b5f23322663c63047962f51b467614
MD5 hash:
48979a1a6d3badea8124bce04b1e01a5
SHA1 hash:
06931bd96343ce167eda796112a30ca8d9fa536a
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
553ace16fbc4f84d8c66ca9a56797fffd527e61215aae4c09d79a55b7653a774
MD5 hash:
d17d4854123369acf81fe7ca2992a36b
SHA1 hash:
0731f10cf277a0458179746f19a7ac121654fd1a
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
Parent samples :
cdb28ec4d453c52e96faf710163c4d792ea3bce7583428c6c15daea470a18884
7d524bc00ec1f1adc67f8f729d295456ec327d04135c68e8d543bd3927cea97f
0e6f61869d37ac6506bd1dcb260d0a76d8e5d8ed156d81b786007c435c788016
29065f6b2ad4d908eacc6dec0b82549a469e13068012b990bcb3f8ed19c94aa5
b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
ac9c912efbed697af7befaef803b15ebd95d29afc2a6cae92886e8a3642afa34
c03be9a117caff7c220bcc199f902b3aec8ab5a1420453122d382d4a8fe7fb61
784bcc73bf933e33d084812f7aea020a47030943f67bb5cc11e1fb0585e40e6d
da981ff73b98d1ab4670f5dcde1e2b956d7acd3ae4af2f6d778ab7cc0ce85701
SH256 hash:
d3c94ac97e882c7478c7e3f718d6fa34287a0fc5fb9d89ad10efd88cba3b5236
MD5 hash:
515283d7a80291b4d4769dbae23b994b
SHA1 hash:
1f237b290ba1b3b5186c38bdece6a558c6623008
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
b6d979d0bc8fa145b49b7b1f39ce6d2a03e956e9969c73e00111b66424b88da3
MD5 hash:
ca34155f9dbf2ad7cee9e1b8d1f50614
SHA1 hash:
859d7b96c0cb604b82d7c0f50e5a1b138285c116
Detections:
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
Parent samples :
cdb28ec4d453c52e96faf710163c4d792ea3bce7583428c6c15daea470a18884
7d524bc00ec1f1adc67f8f729d295456ec327d04135c68e8d543bd3927cea97f
0e6f61869d37ac6506bd1dcb260d0a76d8e5d8ed156d81b786007c435c788016
29065f6b2ad4d908eacc6dec0b82549a469e13068012b990bcb3f8ed19c94aa5
b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
ac9c912efbed697af7befaef803b15ebd95d29afc2a6cae92886e8a3642afa34
c03be9a117caff7c220bcc199f902b3aec8ab5a1420453122d382d4a8fe7fb61
784bcc73bf933e33d084812f7aea020a47030943f67bb5cc11e1fb0585e40e6d
da981ff73b98d1ab4670f5dcde1e2b956d7acd3ae4af2f6d778ab7cc0ce85701
SH256 hash:
19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc
MD5 hash:
5fb6074b08ac4709cf2f29fa5b49023e
SHA1 hash:
8bbb78a47c08867c50572f0bd2a27171f91e0454
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
ad6062215032ab58369403b1221562b5e7fb5ae7d52b29b7fad69eefb2d8455b
MD5 hash:
723f2aaeeda1d2bb2f49322da349ffc9
SHA1 hash:
ac6ab994beaff69adf8a2dc480a8a628175ff6c8
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
9342c7be8036a5f8dc3895d75e3314dce961fd3bc70ee59928c67fa04f0c7e08
MD5 hash:
5419ff27205d3e5affa3fc18b811b843
SHA1 hash:
cf49072c50456381cd26cd32cb97606c5f5cfd26
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
8f76db5d03b4453ec019175ace12988af84e6dd022a909e63794d89364aa70d2
MD5 hash:
e84df8d69dc7b9d66d6cbc0ccb0e4934
SHA1 hash:
d8829c0d46edfff2c1382a0d7cc813b8ae207bbc
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
SH256 hash:
d7610baba5b37a3c52bc19aae6440e7631d1184a3934ebe64f836716b427490d
MD5 hash:
0c3621caaddc9ad7118617d2e1036e10
SHA1 hash:
e1f5e3466022eb8871b9601252da06b743010543
Detections:
SUSP_NET_Shellcode_Loader_Indicators_Jan24
Create hunting rule
INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Link:
https://www.unpac.me/results/65e34e63-6d27-4004-874b-c2406853c6d4/
Parent samples :
cdb28ec4d453c52e96faf710163c4d792ea3bce7583428c6c15daea470a18884
7d524bc00ec1f1adc67f8f729d295456ec327d04135c68e8d543bd3927cea97f
0e6f61869d37ac6506bd1dcb260d0a76d8e5d8ed156d81b786007c435c788016
29065f6b2ad4d908eacc6dec0b82549a469e13068012b990bcb3f8ed19c94aa5
b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3
ac9c912efbed697af7befaef803b15ebd95d29afc2a6cae92886e8a3642afa34
c03be9a117caff7c220bcc199f902b3aec8ab5a1420453122d382d4a8fe7fb61
784bcc73bf933e33d084812f7aea020a47030943f67bb5cc11e1fb0585e40e6d
da981ff73b98d1ab4670f5dcde1e2b956d7acd3ae4af2f6d778ab7cc0ce85701
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/b5957efd8aaa471d73b663405cb17889fac24d72b65aa67805f231f5897850b3

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__API
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:INDICATOR_EXE_DotNET_Encrypted
Create hunting rule
Author:ditekSHen
Description:Detects encrypted or obfuscated .NET executables
Rule name:INDICATOR_RMM_ConnectWise_ScreenConnect
Create hunting rule
Author:ditekSHen
Description:Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:NETexecutableMicrosoft
Create hunting rule
Author:malware-lu
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)
Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/53639/

Comments