MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 f8cd736a531c65cce00a01fab875cb2cc350b4561e6eaa643fb46d1b62cb3ba7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


ConnectWise


Vendor detections: 8


Intelligence 8 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: f8cd736a531c65cce00a01fab875cb2cc350b4561e6eaa643fb46d1b62cb3ba7
SHA3-384 hash: 0b61b27ed952f0dac1d2c3e39e9325a57f796dc55d28c2fd4d56b3d59ceab62084a4a2838e11288d79c3d3f64072e36c
SHA1 hash: 69d1d2ed3ab3519d348748d141dbc12e9c819215
MD5 hash: baf37d8f887d4c5a8d2da49feabd08f2
humanhash: skylark-eight-south-six
File name:f8cd736a531c65cce00a01fab875cb2cc350b4561e6eaa643fb46d1b62cb3ba7
Download: download sample
Signature ConnectWise
Create hunting rule
File size:28'343'776 bytes
First seen:2026-07-14 10:51:19 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 96ab939b3b55d317ed1968d099ccc72c (1 x ConnectWise)
ssdeep 786432:ts0spx677BaQJTNYTscewHQbcNW3g5DplEeukmWVY:tVspx6NaoTNE1eANWwR
Threatray 3'058 similar samples on MalwareBazaar
TLSH T134573303D14EC51CCF5B303951A6F9598BADA862E0385AB7ED8C8E5E47F706702FB924
TrID 50.3% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
10.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
10.5% (.EXE) Win64 Executable (generic) (6522/11/2)
8.1% (.EXE) Win16 NE executable (generic) (5038/12/1)
7.2% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika pebin
dhash icon b2a89c96a2cada72 (2'283 x Formbook, 981 x Loki, 803 x AgentTesla)
Reporter JAMESWT_WT
Tags:ConnectWise exe signed

Code Signing Certificate

Organisation:Edgar Palacios
Issuer:Microsoft ID Verified CS EOC CA 04
Algorithm:sha384WithRSAEncryption
Valid from:2026-06-26T21:21:20Z
Valid to:2026-06-29T21:21:20Z
Serial number: 3300026891d9c3e0b25e0d64de000000026891
Thumbprint Algorithm:SHA256
Thumbprint: 6112792a2a1fdc13a08a88f040ecc838054955c965512837663d67137166c89c
Source:This information was brought to you by ReversingLabs A1000 Malware Analysis Platform

Intelligence

File Origin
# of uploads :
1
# of downloads :
144
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
https://www.lacewalletapp.io/
Verdict:
Malicious activity
Analysis date:
2026-07-03 22:30:20 UTC
Tags:
github screenconnect rmm-tool tool remote auto generic
Link:
https://app.any.run/tasks/f629b688-9c92-4eb6-b75c-c1ecac92eb1c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/74603/
Verdict:
Malicious
Score:
93.3%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a56150d56bd89099b553957
Tags:
shellcode dropper remo
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a file in the %temp% subdirectories
Launching a process
Creating a window
Сreating synchronization primitives
DNS request
Connection attempt
Sending an HTTP GET request
Modifying a system file
Loading a suspicious library
Creating a file in the Windows subdirectories
Deleting a recently created file
Creating a file
Creating a file in the Program Files subdirectories
Creating a service
Launching a service
Creating a process from a recently created file
Searching for synchronization primitives
Moving a file to the Windows subdirectory
Sending a custom TCP request
Using the Windows Management Instrumentation requests
Possible injection to a system process
Enabling autorun with the shell\open\command registry branches
Enabling autorun
Enabling autorun for a service
Unauthorized injection to a recently created process
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
anti-debug expired-cert installer installer installer-heuristic nsis packed reconnaissance revoked-cert short-lived-cert signed
Link:
https://www.filescan.io/uploads/6a56150a0bc091f27f93a007/reports/2fb0ba05-573d-4142-b43a-2e0b48283bf7/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/f8cd736a531c65cce00a01fab875cb2cc350b4561e6eaa643fb46d1b62cb3ba7
Verdict:
Adware
File Type:
exe x32
First seen:
2026-07-01T20:55:00Z UTC
Last seen:
2026-07-11T22:55:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/f8cd736a531c65cce00a01fab875cb2cc350b4561e6eaa643fb46d1b62cb3ba7/results?tab=lookup
Score:
11%
Verdict:
Benign
File Type:
PE
Link:
https://malprob.io/report/f8cd736a531c65cce00a01fab875cb2cc350b4561e6eaa643fb46d1b62cb3ba7
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PE (Portable Executable) PE Memory-Mapped (Dump)
Link:
https://app.malva.re/file/baf37d8f887d4c5a8d2da49feabd08f2
Gathering data
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=7dgxg2stdrs4zyakah5lq5olftbvbncwdzxkuzb7wrwrwywlhotq._file
Verdict:
suspicious
Label(s):
admintool_screenconnect
Create hunting rule
Similar samples:
26fbda92490b8ab92a28b709b11b31361266714200fa8954f91bb0bbc96e9c2a
ConnectWise
4990164c8296288b93e66901737c1840b43a71adc06ad0ab8ab2bb50aaad22a8
ConnectWise
527a521f0cca55ce3bed8b03b9b0917d0929682a0bbd55c15c4e2e449121c644
ConnectWise
64049e058f3414066b1b68f84306ec307670b4e93543888b6e40d8e18b74b718
ConnectWise
64adb568ceb1d4abb36113bde0ca9bffa423be366262f8a4ec75b1e23aef50ad
ConnectWise
9a40b944c4c7c470a8a958e5ff86e814ba135d04b0c071b856d23f9b1108d81f
ConnectWise
error
ConnectWise
f28a060cd841574451960ddc5f2a706526597e361b1a7eb86245488aaa431014
ConnectWise
+ 3'048 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery persistence privilege_escalation revoked_codesign
Link:
https://tria.ge/reports/260714-myt1taa12k/
Behaviour
Checks processor information in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
System Location Discovery: System Language Discovery
Drops file in Program Files directory
Drops file in Windows directory
Boot or Logon Autostart Execution: Authentication Package
Drops file in System32 directory
Badlisted process makes network request
Checks installed software on the system
Enumerates connected drives
Event Triggered Execution: Component Object Model Hijacking
Executes dropped EXE
Loads dropped DLL
Sets service image path in registry
Signed with revoked ConnectWise certificate
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Detect_NSIS_Nullsoft_Installer
Create hunting rule
Author:Obscurity Labs LLC
Description:Detects NSIS installers by .ndata section + NSIS header string
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/74603/

Comments