Report - 079fe697069f…a4298c10d8

Malicious CriticalFILE

Quota 42

First seen: 2026-11-01T02:12:22Z
Last seen: 2026-11-11T04:49:21Z

THREAT SIGNALMedium-high Read alongside the verdict

CONFIDENCE100%VirusSign analysis

FAMILYconnectwisehacktool

RELATED INDICATORS16Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

SHA256: 079fe697069f4fa94a73754d356e3084053427fed92cea0f2c7e2ea4298c10d8
SHA1: 5960307dd3d17684f1b124e340006bed56abad84
MD5: ed8f2bc09831a53cb5df11c30b4f0f08
Filename: 079fe697_us573web.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 12842552
Compile time: 2022-11-18T20:10:20Z
PE platform: x86 32-bit
PE sections: 5

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 35%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections35%

VirusSign confidence100%

Relationship context16 visible

Threat classificationconnectwise

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

16 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

4shown

d82e523258d210720be79273a4821dd5a0fced1f91f879d75d45c421e939bc74

0% xml 883 bytes drops

Filename d82e5232_user.config.bin File type xml MIME application/xml Size 883 SHA1 873eaee1054801a250ea023602f665531c7776a9

ac0c4b51f6d244e1dc70890c9490dabea4973597a89bf7269ca8d4e32e584ad4

20% high msi 10256384 bytes drops

Filename ac0c4b51_screenconnect.clientsetup.msi.bin Family connectwise Type hacktool File type msi MIME application/x-msi

d39e53d74c6840d331b91b9c949db26f7c93a824e9fb104c532346a8c465b6e2

4% medium pedll 1161744 bytes drops

Filename d39e53d7_msi55f9.tmp.bin Family msil Type pua File type pedll MIME application/vnd.microsoft.portable-executable

c97f86b5acd35e9ed38289726d3161f735212742ad5f2b113bec17ec3eb4c239

0% javascript 321 bytes drops

Filename c97f86b5_sinc-sconnect.clientsetup _23_.exe.log.bin File type javascript MIME application/javascript Size 321 SHA1 447cebed1e07feffeec3b186a01ab2129374115e

Related IPs

Network IPs associated with this indicator.

5shown

54.145.58.171

US communicates

CIDR 54.144.0.0/14 Network 54.144.0.0-54.147.255.255 First seen 2025-06-15T09:40:23Z Last seen 2026-11-13T09:46:31Z

34.203.114.159

US communicates

CIDR 34.192.0.0/12 Network 34.192.0.0-34.255.255.255 First seen 2026-10-15T14:23:14Z Last seen 2026-11-13T09:46:31Z

52.206.22.170

0% US communicates

CIDR 52.200.0.0/13 Network 52.192.0.0-52.223.191.255 First seen 2024-05-06T00:24:38Z Last seen 2026-11-13T09:46:31Z

15.204.184.14

0% US communicates

CIDR 15.204.0.0/16 Network 15.204.184.0-15.204.184.127 First seen 2025-01-22T08:05:32Z Last seen 2026-11-13T00:02:56Z

108.138.192.87

US communicates

CIDR 108.136.0.0/14 Network 108.138.0.0-108.139.255.255 First seen 2024-06-01T05:25:35Z Last seen 2026-11-11T04:49:21Z

Related domains

Domains associated with this indicator.

5shown

instance-kiscll-relay.screenconnect.com

0% .com communicates

Root screenconnect.com TLD com Subdomain instance-kiscll-relay First seen 2026-03-13T14:13:04Z Last seen 2026-11-11T04:49:21Z

ec2-52-206-22-170.compute-1.amazonaws.com

.com communicates

Root amazonaws.com TLD com Subdomain ec2-52-206-22-170.compute-1 First seen 2026-10-29T08:52:04Z Last seen 2026-11-11T04:49:21Z

ip14.ip-15-204-184.us

.us communicates

Root ip-15-204-184.us TLD us Subdomain ip14 First seen 2025-10-23T04:34:26Z Last seen 2026-11-11T04:49:21Z

check.screenconnect.com

0% .com communicates

Root screenconnect.com TLD com Subdomain check First seen 2023-10-01T14:51:48Z Last seen 2026-11-15T02:32:31Z

screenconnect.com

0% .com communicates

Root screenconnect.com TLD com First seen 2023-10-01T11:49:10Z Last seen 2026-11-15T02:32:31Z

Related URLs

URLs associated with this indicator.

2shown

https://check.screenconnect.com/InstallerOriginInfo.axd

0% communicates

TLD com HTTP status 200 First seen 2026-02-27T03:09:48Z Last seen 2026-11-15T02:32:31Z

http://crt.rootg2.amazontrust.com/rootg2.cer

0% communicates

TLD com HTTP status 200 Content length 1145 Content SHA256 28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996 First seen 2016-07-14T21:11:22Z

Analysis details

Severity: criticalhacktooladapter-discoverywmi-activityexec-delayfile-overlaypersistenceexeobfuscateddebug-checkconnectwisepuasigned

Freshness: Fresh · Last seen 3 days ago.

Detection rate: 35%
Threat type: hacktool
Family: connectwise
Confidence: 100%
detection: 35 · Engine detection rate; color may also reflect VirusSign confidence.

Overview

SHA256: 079fe697069f4fa94a73754d356e3084053427fed92cea0f2c7e2ea4298c10d8
SHA1: 5960307dd3d17684f1b124e340006bed56abad84
MD5: ed8f2bc09831a53cb5df11c30b4f0f08
Filename: 079fe697_us573web.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 12842552
Compile time: 2022-11-18T20:10:20Z
PE platform: x86 32-bit
PE sections: 5
Import libraries: 3
TLSH: T130D61211B3F59675D1FB0638E87AA3615A35BC014B12C7AF6794792A2D327C08E323B7
SSDEEP: 393216:rFri04SOLGX1FFri04SOLmFri04SOLAFri04SOL4:rMrSOLcLMrSOLmMrSOLAMrSOL4
Imphash: 9771ee6344923fa220489ab01239bdfd
Richhash: a498773e40e07b36d0f4a2dab1633f09
First seen: 2026-11-01T02:12:22Z
Last seen: 2026-11-11T04:49:21Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

Elevated engine detections. Related indicators in this report: 16. Review the supporting evidence before taking action.

Detection signal

Malicious. Engine detections are elevated at 35%.

Confidence signal

VirusSign reports 100% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type hacktool and family connectwise.

Relationship context

16 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

17 timestamped observations are arranged from 2012-12-24 to 2026-11-01. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

Engine detections are elevated in this report. Review the reported confidence, classification and relationships alongside them.

Engine detections 35%

Reported engine detection rate, not the probability that this indicator is malicious.

VirusSign confidence 100%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 16 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification connectwise

Classification context: type hacktool, family connectwise.

Intelligence freshness Fresh

Last seen 3 days ago.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: 079fe697_us573web.exe.bin
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 12842552
Compile time: 2022-11-18T20:10:20Z
PE platform: x86 32-bit
Entry point: 5293
Sections: 5

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityadapter-discoverydebug-checkexec-delayobfuscatedpersistence

View details · 5 shown

A DLL was loaded from a suspicious directory
A named pipe was used for inter-process communication
Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Allocates memory with a write watch (potentially for evading sandboxes)
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1071 — A named pipe was used for inter-process communication
Tactics: TA0011
T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Tactics: TA0004 · TA0005
T1497 — Allocates memory with a write watch (potentially for evading sandboxes)
Tactics: TA0005 · TA0007
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0001.002 — CheckRemoteDebuggerPresent
Objectives: OB0001
Communication
Objectives: OC0006
C0060 — Compression Library
Objectives: OC0004

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5+

HTTP, TCP, UDPports 443, 53

5+ outbound connections observed
2 domains, 3 IPs, 2 URLs
Common ports: 443, 53
Protocols: HTTP, TCP, UDP

View details · 5 shown

Domain: check.screenconnect.com
URL: https://check.screenconnect.com/installerorigininfo.axd
Protocol: HTTP

Domain: crt.rootg2.amazontrust.com
URL: http://crt.rootg2.amazontrust.com/rootg2.cer
Protocol: HTTP

IP: 52.206.22.170
Port: 443
Protocol: TCP

IP: 162.159.36.2
Port: 53
Protocol: UDP

IP: 15.204.184.14
Port: 443
Protocol: TCP

DNS request activity5+

A5+ response IPs

5+ DNS requests observed
5+ unique queries
5+ response IPs
Query types: A
Response codes: NOERROR

View details · 5 shown

Query: cl-glcb907925.gcdn.co
Type: A
Answers: 92.223.96.6
Response: NOERROR

Query: ip14.ip-15-204-184.us
Type: A
Answers: 15.204.184.14
Response: NOERROR

Query: instance-kiscll-relay.screenconnect.com
Type: A
Answers: 15.204.184.14
Response: NOERROR

Query: ec2-52-206-22-170.compute-1.amazonaws.com
Type: A
Answers: 52.206.22.170
Response: NOERROR

Query: crt.rootg2.amazontrust.com
Type: A
Answers: 108.138.192.87
Response: NOERROR

5 shown

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5 sections

Platform: x86 32-bit
Sections: 5
Entry point: present
Compile time: 2022-11-18T20:10:20Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 5293
Sections: 5
Compile time: 2022-11-18T20:10:20Z

PE sections5

5 sections

5 PE sections
Common permissions: r, rw, rx
5 unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 45487
Raw size: 45568
Permissions: rx
Entropy: 6.59

Name: .rdata
Virtual address: 53248
Virtual size: 24696
Raw size: 25088
Permissions: r
Entropy: 4.79

Name: .data
Virtual address: 81920
Virtual size: 4580
Raw size: 2048
Permissions: rw
Entropy: 2.27

Name: .rsrc
Virtual address: 90112
Virtual size: 12758552
Raw size: 12759040
Permissions: r
Entropy: 7.81

Name: .reloc
Virtual address: 12849152
Virtual size: 3752
Raw size: 4096
Permissions: r
Entropy: 6.3

Imports3

3 DLL groups

3 import DLL groups
5+ imported functions summarized

View details · 3 shown

Library: mscoree.dll
Functions: CorBindToRuntimeEx

Library: KERNEL32.dll
Functions: CloseHandle, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose …

Library: OLEAUT32.dll
Functions: SafeArrayAccessData, SafeArrayCreateVector, SafeArrayDestroy, SafeArrayUnaccessData, VariantClear, VariantInit

Resources5+

5+ resources

5+ resources
Resource types: FILES, RT_MANIFEST, RT_RCDATA, RT_VERSION

View details · 4 shown

Type: FILES
Language: NEUTRAL

Type: RT_RCDATA
Language: NEUTRAL

Type: RT_VERSION
Language: ENGLISH US

Type: RT_MANIFEST
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

4 issuers

Example subject: ConnectWise, LLC
Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Validity period (UTC): 2026-02-20 – 2027-02-19

View details · 5 shown

Subject: ConnectWise, LLC
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Valid from: 1771545600.0
Valid to: 1803081540.0
Fingerprint: C1603341F3EB5AF6A5601C90CF8937EDC06D54E7

Subject: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Issuer: DigiCert Trusted Root G4
Valid from: 1619654400.0
Valid to: 2093039940.0
Fingerprint: 7B0F360B775F76C94A12CA48445AA2D2A875701C

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Trusted Root G4
Valid from: 1375358400.0
Valid to: 2147169600.0
Fingerprint: DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check