MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6
SHA3-384 hash:	f06570bb5e6d1c4e2da7ae6efebe8896517bdd86896f901993fc064b99f7245ae5eb4ac4ac89bb7fe7e3aac2ef11b642
SHA1 hash:	bbf57300b43c53857d6fb25f46b9f15b76fbf382
MD5 hash:	1ef0113bc0e9e2d0efe9021c0b3421e8
humanhash:	july-sodium-autumn-low
File name:	dsetup.dll
Download:	download sample
Signature	ConnectWise Alert Create hunting rule
File size:	83'886'080 bytes
First seen:	2026-07-10 02:57:29 UTC
Last seen:	Never
File type:	dll
MIME type:	application/x-dosexec
imphash	f1783104dc04202edb1280448f79953f (4 x ConnectWise)
ssdeep	1572864:s/2rwnAPGuRuAKEFx3hWt+dVGsmFi9lL8YycbwcnzCm2fSngYfian7MiefV3Qd6O:saKA+AnFx3hWt+ndZ8Yycbjnun2vxPt
TLSH	T12A083312B2C8E53EE0B71A35687FE211593B7A147A22CD0F27A0095C5FF7A406E29F57
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	aachum
Tags:	ConnectWise dll micro-vpn-expres-top

iamaachum

https://ryujinx.co/ and https://ryujinx.dev/download.html => https://start-download.duckdns.org/ryujinx/2gle1u2i83oyapzk5k541o

ConnectWise ScreenConnect C2: micro.vpn-expres.top

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

218

Origin country :

ES

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

81.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a505fac13f68731ed6b4465

Tags:

virus

Dr. Web vxCube Clean

Result

Verdict:

Clean

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Сreating synchronization primitives

Creating a process from a recently created file

Creating a window

Searching for synchronization primitives

Creating a file

Deleting a recently created file

FileScan.IO Likely Malicious

Verdict:

Likely Malicious

Threat level:

  7.5/10

Confidence:

100%

Tags:

adaptive-context anti-debug anti-vm evasive fingerprint hacktool lolbin microsoft_visual_cc msiexec overlay

Link:

https://www.filescan.io/uploads/6a505fdcc9b818492584ded2/reports/dd49f1fb-4544-4b18-a73f-0f69587d7649/overview

Hybrid Analysis Yogi.Generic

Verdict:

Malicious

Labled as:

Yogi.Generic

Link:

https://www.hybrid-analysis.com/sample/c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

dll x32

First seen:

2026-07-08T17:27:00Z UTC

Last seen:

2026-07-11T21:43:00Z UTC

Hits:

~100

Detections:

UDS:DangerousObject.Multi.Generic not-a-virus:HEUR:RemoteAdmin.MSIL.ConnectWise.gen not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen

Link:

https://opentip.kaspersky.com/c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6/results?tab=lookup

Joe Sandbox ScreenConnect Tool

Result

Threat name:

ScreenConnect Tool

Alert

Create hunting rule

Detection:

malicious

Classification:

evad

Score:

92 / 100

Link:

https://www.joesandbox.com/analysis/1940343

Signature

.NET source code contains potential unpacker

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Contains functionality to hide user accounts

Enables network access during safeboot for specific services

Joe Sandbox ML detected suspicious sample

Modifies security policies related information

Multi AV Scanner detection for submitted file

Reads the Security eventlog

Reads the System eventlog

Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

96%

Verdict:

Malware

File Type:

PE

Link:

https://malprob.io/report/c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6

CERT.PL MWDB

Gathering data

Neiki RemoteAdmin.Win32.ConnectWise

Verdict:

Malicious

Threat:

RemoteAdmin.Win32.ConnectWise

Link:

https://tip.neiki.dev/file/c25a08d59a215dce54ce9aed5636d5958eb6b87daee3b40ae666f92951be37f6

ReversingLabs TitaniumCloud Win32.Trojan.Ravartar

Threat name:

Win32.Trojan.Ravartar

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-07-08 23:01:08 UTC

File Type:

PE (Dll)

Extracted files:

8135

AV detection:

14 of 24 (58.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yjnarvm2efo44vgotlwvmnwvswhlnod5v3r3icxgm34ssun6g73a._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

discovery persistence privilege_escalation revoked_codesign

Link:

https://tria.ge/reports/260710-dgg59adw2x/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Boot or Logon Autostart Execution: Authentication Package

Drops file in System32 directory

Checks for any installed AV software in registry

Checks installed software on the system

Enumerates connected drives

Checks computer location settings

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Sets service image path in registry

Signed with revoked ConnectWise certificate

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.