🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 11


Intelligence 11 IOCs YARA 5 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79
SHA3-384 hash: 5dfd0741d45a938f6ba2c3b189d036ba5c9d9100d2cc6b52dca87db63031b2b11be7a993e4a57a44c98c7dd1637cd159
SHA1 hash: 98661a28d73703ec3728e8f9b25dfab043f4ca6f
MD5 hash: a40e6ca64bbeaf7e42100371defa2c51
humanhash: yankee-skylark-undress-idaho
File name:sysupdate.ps1
Download: download sample
Signature ConnectWise
Create hunting rule
File size:2'497 bytes
First seen:2026-04-14 19:15:58 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 48:LWbqvD+XSTqFjtt9P7FFbAoCj6Vvf4wIf2IXmPxaaH5SbM:LWbqvD+X1jttxF6o7gf2X0aog
TLSH T1AD51B8086903EB6DC0706789AA916A15D45F41BFD2302A1871FCDD085FB89341FFE6EE
Magika powershell
Reporter smica83
Tags:ps1

Intelligence

File Origin
# of uploads :
1
# of downloads :
129
Origin country :
HU HU
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.PUA.IA.Suspicious.58874445.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69de927d45787c53e539b867
Tags:
connectwise shell agent sage
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
powershell
Link:
https://www.filescan.io/uploads/69de927b5ea31bc68a2a9d5a/reports/dd449c2d-cc0a-4ce5-83ef-c4a49fb11be8/overview
Verdict:
Suspicious
Labled as:
PowerShell/Bypass.D suspicious application
Link:
https://www.hybrid-analysis.com/sample/ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79
Verdict:
Malicious
File Type:
csc
Link:
https://opentip.kaspersky.com/ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79/results?tab=lookup
Result
Threat name:
ScreenConnect Tool
Create hunting rule
Detection:
malicious
Classification:
troj.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1898301
Signature
.NET source code references suspicious native API functions
AI detected malicious Powershell script
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Contains functionality to hide user accounts
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Powershell drops PE file
Reads the Security eventlog
Reads the System eventlog
Sigma detected: Remote Access Tool - ScreenConnect Backstage Mode Anomaly
Sigma detected: Remote Access Tool - ScreenConnect Suspicious Execution
UAC bypass detected (Fodhelper)
Uses known network protocols on non-standard ports
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1898301 Sample: sysupdate.ps1 Startdate: 14/04/2026 Architecture: WINDOWS Score: 100 71 legitserver.theworkpc.com 2->71 79 Antivirus detection for URL or domain 2->79 81 .NET source code references suspicious native API functions 2->81 83 Contains functionality to hide user accounts 2->83 85 5 other signatures 2->85 10 powershell.exe 17 68 2->10         started        15 ScreenConnect.ClientService.exe 2 10 2->15         started        signatures3 process4 dnsIp5 73 legitserver.theworkpc.com 45.138.16.64, 49692, 49694, 49695 SPECTRAIPSpectraIPBVNL Netherlands 10->73 61 C:\...\ScreenConnect.WindowsFileManager.exe, PE32 10->61 dropped 63 C:\...\ScreenConnect.WindowsClient.exe, PE32 10->63 dropped 65 ScreenConnect.WindowsBackstageShell.exe, PE32 10->65 dropped 69 5 other malicious files 10->69 dropped 87 UAC bypass detected (Fodhelper) 10->87 89 Loading BitLocker PowerShell Module 10->89 91 Powershell drops PE file 10->91 17 ComputerDefaults.exe 12 10->17         started        19 csc.exe 4 10->19         started        22 conhost.exe 10->22         started        67 C:\Windows\SystemTemp\...\rgNbDzD7S0qorun.cmd, ASCII 15->67 dropped 93 Reads the Security eventlog 15->93 95 Reads the System eventlog 15->95 24 cmd.exe 15->24         started        26 cmd.exe 15->26         started        28 ScreenConnect.WindowsClient.exe 2 15->28         started        31 2 other processes 15->31 file6 signatures7 process8 file9 33 uds.exe 1 17->33         started        51 C:\Systems\uds.exe, PE32 19->51 dropped 36 cvtres.exe 1 19->36         started        38 Dism.exe 24->38         started        41 powershell.exe 26->41         started        97 Contains functionality to hide user accounts 28->97 signatures10 process11 file12 75 Bypasses PowerShell execution policy 33->75 43 powershell.exe 14 17 33->43         started        53 C:\Windows\Temp\...\WimProvider.dll.mui, PE32 38->53 dropped 55 C:\Windows\Temp\...\VhdProvider.dll.mui, PE32 38->55 dropped 57 C:\Windows\Temp\...\UnattendProvider.dll.mui, PE32 38->57 dropped 59 47 other files (none is malicious) 38->59 dropped 45 DismHost.exe 38->45         started        77 Loading BitLocker PowerShell Module 41->77 signatures13 process14 process15 47 conhost.exe 43->47         started        49 sc.exe 1 43->49         started       
Score:
55%
Verdict:
Susipicious
File Type:
SCRIPT
Link:
https://malprob.io/report/ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79/
Verdict:
Malicious
Link:
https://tip.neiki.dev/file/ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-04-14 19:17:05 UTC
File Type:
Text (PowerShell)
AV detection:
4 of 38 (10.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=5y6xo3g27artlzbjhym64mj4ynpo4son5gldxftwnkhzzcoujj4q._file
Result
Malware family:
n/a
Score:
  10/10
Tags:
discovery execution persistence
Link:
https://tria.ge/reports/260414-xy8t3sat3j/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
System Location Discovery: System Language Discovery
Drops file in Windows directory
Launches sc.exe
Drops file in System32 directory
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Command and Scripting Interpreter: PowerShell
Sets service image path in registry
Malware Config
Dropper Extraction:
http://legitserver.theworkpc.com:5443/OneDriveServer.zip
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
0.95
Link:
https://yomi.yoroi.company/submissions/ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:detect_powershell
Create hunting rule
Author:daniyyell
Description:Detects suspicious PowerShell activity related to malware execution
Rule name:Detect_PowerShell_Obfuscation
Create hunting rule
Author:daniyyell
Description:Detects obfuscated PowerShell commands commonly used in malicious scripts.
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

ConnectWise

PowerShell (PS) ps1 ee3d776cdaf82335e4293e19ee313cc35eee49cde9963b96766a8f9c89d44a79

(this sample)

ConnectWise

zip 7adffc1c0b3fdcba46e8d0a81203c955976d4ef39893c98d0b2dbfbb8d6a8ec3

  
Dropping
SHA256 7adffc1c0b3fdcba46e8d0a81203c955976d4ef39893c98d0b2dbfbb8d6a8ec3
  
Dropping
MD5 752a7188f2bab1926a63254e29f3108a

Comments