MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cdcd5f2b289d8c9354c05b55e970218bceaf61d1decd05a628fc34799b7df0a1. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

ConnectWise

Vendor detections: 11

Intelligence 11 IOCs YARA 14 File information Comments

SHA256 hash:	cdcd5f2b289d8c9354c05b55e970218bceaf61d1decd05a628fc34799b7df0a1
SHA3-384 hash:	b2f5c38566ec363aab743804164c7666f42a5202ac69e046c78f2ff392113fa9626f53994561982a429320c3f96a9d54
SHA1 hash:	c09d2ade2ae1a637f84c660cb48ad030e071bf00
MD5 hash:	c32a11c53e93dcf9fcf66847e3b1f48f
humanhash:	thirteen-oven-idaho-cup
File name:	ScreenConnect.ClientSetup.exe
Download:	download sample
Signature	ConnectWise Create hunting rule
File size:	5'680'120 bytes
First seen:	2026-08-22 13:46:31 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9771ee6344923fa220489ab01239bdfd (720 x ConnectWise)
ssdeep	98304:vzIus6efPUIdoaxcp8wy5c3trGOlkQ5DUOgJ9zl:vhfefPtHxcp9ym3nltDUJV
TLSH	T13846E101B3D695B6D1BF1638D87A52696734BC049316CBBF5394BD392E32BC04E323A6
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	BlinkzSec
Tags:	ConnectWise signed

Code Signing Certificate

Organisation:	Connectwise, LLC
Issuer:	DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Algorithm:	sha256WithRSAEncryption
Valid from:	2022-08-17T00:00:00Z
Valid to:	2025-08-15T23:59:59Z
Serial number:	0b9360051bccf66642998998d5ba97ce
Intelligence:	1141 malware samples on MalwareBazaar are signed with this code signing certificate
Thumbprint Algorithm:	SHA256
Thumbprint:	82b4e7924d5bed84fb16ddf8391936eb301479cec707dc14e23bc22b8cdeae28
Source:	This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin

# of uploads :

# of downloads :

Origin country :

Vendor Threat Intelligence

No detections

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/82485/

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% subdirectories

Launching a process

Creating a file

Creating a window

Сreating synchronization primitives

Searching for synchronization primitives

Loading a suspicious library

Deleting a recently created file

Modifying a system file

Creating a file in the Windows subdirectories

Creating a file in the Program Files subdirectories

Enabling autorun with the shell\open\command registry branches

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug base64 corrupted evasive expand expired-cert lolbin microsoft_visual_cc overlay packed packed privilege reconnaissance revoked-cert rundll32 signed

Link:

https://www.filescan.io/uploads/6a89a89b4e0e9422eb014d59/reports/8f004de3-2653-4afe-ade9-bc45cfb95f65/overview

Verdict:

Malicious

Labled as:

HackTool/ConnectWiseControl.i

Link:

https://www.hybrid-analysis.com/sample/cdcd5f2b289d8c9354c05b55e970218bceaf61d1decd05a628fc34799b7df0a1

Malware family:

ConnectWise Inc

Verdict:

Suspicious

Link:

https://analyze.intezer.com/analyses/4aa48e90-e774-47e9-b485-492894f7ecec

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cdcd5f2b289d8c9354c05b55e970218bceaf61d1decd05a628fc34799b7df0a1

Verdict:

inconclusive

YARA:

9 match(es)

Tags:

.Net CAB:COMPRESSION:LZX Executable Managed .NET PDB Path PE (Portable Executable) PE File Layout SOS: 0.00 SOS: 0.07 SOS: 0.21 SOS: 0.23 SOS: 0.24 SOS: 0.25 SOS: 0.26 SOS: 0.27 SOS: 0.31 SOS: 0.32 SOS: 0.36 SOS: 0.39 Win 32 Exe x86

Link:

https://app.malva.re/file/c32a11c53e93dcf9fcf66847e3b1f48f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cdcd5f2b289d8c9354c05b55e970218bceaf61d1decd05a628fc34799b7df0a1/

Threat name:

Win32.Trojan.Suschil

Status:

Malicious

First seen:

2026-08-22 13:45:41 UTC

File Type:

PE (Exe)

Extracted files:

174

AV detection:

11 of 24 (45.83%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=zxgv6kzitwgjgvgalnk6s4bbrphk6yor33gqljri7q2htg356cqq._file

Verdict:

malicious

Label(s):

ADMINTOOL_ScreenConnect

Link:

https://reports.threatray.com/e44a935f-6045-41e5-848c-3768a72db72a

Result

Malware family:

n/a

Score:

8/10

Tags:

discovery ransomware revoked_codesign

Link:

https://tria.ge/reports/260822-q3mdbahk2t/

Behaviour

Checks SCSI registry key(s)

Modifies data under HKEY_USERS

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Uses Volume Shadow Copy service COM API

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Drops file in Program Files directory

Drops file in Windows directory

Enumerates connected drives

Checks computer location settings

Loads dropped DLL

Signed with revoked ConnectWise certificate

Unpacked files

SH256 hash:

cdcd5f2b289d8c9354c05b55e970218bceaf61d1decd05a628fc34799b7df0a1

MD5 hash:

c32a11c53e93dcf9fcf66847e3b1f48f

SHA1 hash:

c09d2ade2ae1a637f84c660cb48ad030e071bf00

Detections:

triage_screenconnect_rat

Link:

https://www.unpac.me/results/db6250ba-1d47-47af-846d-eca4ea3e66c0/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/cdcd5f2b289d8c9354c05b55e970218bceaf61d1decd05a628fc34799b7df0a1

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	INDICATOR_EXE_DotNET_Encrypted Create hunting rule
Author:	ditekSHen
Description:	Detects encrypted or obfuscated .NET executables

Rule name:	INDICATOR_RMM_ConnectWise_ScreenConnect Create hunting rule
Author:	ditekSHen
Description:	Detects ConnectWise Control (formerly ScreenConnect). Review RMM Inventory

Rule name:	INDICATOR_RMM_ConnectWise_ScreenConnect_CERT Create hunting rule
Author:	ditekSHen
Description:	Detects ConnectWise Control (formerly ScreenConnect) by (default) certificate. Review RMM Inventory

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/