MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 10

Intelligence 10 IOCs YARA 2 File information Comments

SHA256 hash:	c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48
SHA3-384 hash:	49b2ce40c38999b6aefa08aa749d4687ca59816191c55621c52ab8a37a4c0a248733a05309f8feb7ce25c834a6c5f4b5
SHA1 hash:	0cc83f6f915c6977cb5a0c5a1c46a2a82c0ad63a
MD5 hash:	6f57cf15aa31a5b87b4eee3f02848d70
humanhash:	johnny-mobile-four-cold
File name:	New-statement.vbs
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	1'519 bytes
First seen:	2026-06-02 13:37:24 UTC
Last seen:	Never
File type:	vbs
MIME type:	text/plain
ssdeep	24:XhUcuwF5URnas9AH5K+aLRmxWCuG2Olw+AvkI0JfXzl7tKRXTzQebr1XbM7S5fLx:XeXAZGtUWG2gw+Cl0Jf57tKRRpNZ7GA/
Threatray	2'495 similar samples on MalwareBazaar
TLSH	T1DE31959A6B05E237253A4793B173E44ED373884D2C24A4697C21C48A1E354F88BAE4A7
Magika	vba
Reporter	malwarology
Tags:	vbs

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/68798/

Verdict:

Malicious

Score:

92.5%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a1edcc757b7bf261d60495e

Tags:

trojandownloader connectwise dropper html

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

evasive expand lolbin masquerade obfuscated rundll32

Link:

https://www.filescan.io/uploads/6a1edccb12da0d249c616dd6/reports/8c2c2079-ce05-4837-9d48-0c006b08f2f0/overview

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48

Verdict:

Malicious

File Type:

vbs

First seen:

2026-05-28T21:05:00Z UTC

Last seen:

2026-06-04T01:42:00Z UTC

Hits:

~100

Detections:

PDM:Trojan.Win32.Generic Trojan.JS.SAgent.sb HEUR:Trojan.VBS.SAgent.gen RemoteAdmin.ConnectWise.HTTP.C&C

Link:

https://opentip.kaspersky.com/c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48/results?tab=lookup

Score:

95%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48

Gathering data

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48/

Verdict:

Malicious

Threat:

RemoteAdmin.ConnectWise.HTTP

Link:

https://tip.neiki.dev/file/c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48

Threat name:

Script-WScript.Trojan.Heuristic

Status:

Malicious

First seen:

2026-06-02 13:38:24 UTC

File Type:

Text (VBS)

AV detection:

6 of 24 (25.00%)

Threat level:

2/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=yofwgr6bsnarikn3angzjjaqomajuy3sn3cmziptdezxtqk6lzea._file

Verdict:

suspicious

Label(s):

admintool_screenconnect

ConnectWise

3c46671af655e0a0b864208dd7a2ab5cd5a9d1f095c1b2fc0f7882d62ddae275

ConnectWise

44b6aceca9302e75538237faf85946c7833c28e290de8941e50c72e6310e043a

ConnectWise

46ac606e6931d657bc152dfb64a6fce61495335ce27408e758290168c7226db0

ConnectWise

542feb5ab4ad77196b837adf10e237947ca01c4a69eac7613f8ebafba2d45908

ConnectWise

8f19d0c3444439ed0550153d6c8943ca343154706e473cd7f3458f7f82880c7d

ConnectWise

9b3296db81da2719713c5af6ad8a09213f7c676f0cc6858174a63a2cfa4f387d

ConnectWise

ab4e3cdb02791dda97abd220f89cd5e9f0ba404d48b87e17213a526674729abf

ConnectWise

ba76a414a8c32b0579a41110731c6d5bb109a02450849d8bd8484ee6e855239c

ConnectWise

ec6069de8aadd7f83d0d251c51c00ff009a0e3bfd8b4a0b19e269f08e15ce9b2

ConnectWise

error

ConnectWise

+ 2'485 additional samples on MalwareBazaar

Result

Malware family:

n/a

Score:

8/10

Tags:

backdoor discovery persistence privilege_escalation rat revoked_codesign

Link:

https://tria.ge/reports/260602-qxf94sfx6l/

Behaviour

Checks processor information in registry

Modifies data under HKEY_USERS

Modifies registry class

Script User-Agent

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Boot or Logon Autostart Execution: Authentication Package

Drops file in System32 directory

Enumerates connected drives

Checks computer location settings

ConnectWise ScreenConnect remote access tool

Deletes itself

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Loads dropped DLL

Badlisted process makes network request

Sets service image path in registry

Signed with revoked ConnectWise certificate

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/c38b6347c193411429bb034d94a41073009a63726ec4cca1f3193379c15e5e48

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.