Report - 6e80cf0dc0bc…060ee4091d

Malicious HighFILE

Quota 30

First seen: 2026-11-10T21:39:02Z
Last seen: 2026-11-11T00:37:20Z

THREAT SIGNALMedium Read alongside the verdict

CONFIDENCE92%VirusSign analysis

FAMILYconnectwisehacktool

RELATED INDICATORS14Connections in this report

ANALYSISMaliciousFresh

Indicator overview

INDICATOR PROFILE

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

SHA256: 6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
SHA1: f7942088103a877441839f4bca791243c9953a81
MD5: 0f01f5e2886a4be432d5a4f9fd1f93bb
Filename: ScreenConnect.ClientSetup.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 12846648
Compile time: 2022-11-18T20:10:20Z
PE platform: x86 32-bit
PE sections: 5

Connected context

Key findings

OBSERVED EVIDENCE

Analysis takeaway

High-confidence evidence. Related indicators in this report: 14. Review the supporting evidence before taking action.

Detection signal

Malicious. A limited set of engine detections is present (17%).

Confidence signal

VirusSign reports 92% confidence. Review this alongside engine detections and relationship evidence.

Analysis signals

OBSERVED

Engine detections17%

VirusSign confidence92%

Relationship context14 visible

Threat classificationconnectwise

Related intelligence

Pivot across connected files and infrastructure with analysis signals and supporting context.

14 shown

Dropped / child files

Files dropped, bundled, or created by the queried file.

5shown

f751ccdd41a060c1609813602f7d87cf7fcd36743a30ed64c8489ac4e674545d

5% medium pedll 1164184 bytes drops

Filename MSIB418.tmp Family msil Type pua File type pedll MIME application/vnd.microsoft.portable-executable

c5368ffee032a2110b69f9d30820646f5f20e71844a6bcd43fe6adefa1a50401

0% xml 884 bytes drops

Filename user.config File type xml MIME application/xml Size 884 SHA1 01ab5d48834acb2ff1f8bc517091c989999cd022

660f6f57e25ba67bb88b33fefd124cb3f70230baf80198eb5ce6f4d78dc1c23a

19% high msi 10260480 bytes drops

Filename ScreenConnect.ClientSetup.msi Family connectwise Type hacktool File type msi MIME application/x-msi

a5191e82c924733b8a131d7f479c7b7e11755e3e6e996b325f9c0758c0587f33

5% medium pedll 1746944 bytes contains

Filename t5j1gn59p.exe Family msil Type pua File type pedll MIME application/vnd.microsoft.portable-executable

3d15e680ca51b0918fd96a8e045cc36cdcb01d8c2be8448712839ac574813db5

0% peexe 19968 bytes contains

Filename ScreenConnect.ClientInstallerRunner.exe File type peexe MIME application/vnd.microsoft.portable-executable Size 19968 Compile time 2076-08-11T02:11:17Z

Related IPs

Network IPs associated with this indicator.

5shown

15.204.241.181

0% US communicates

CIDR 15.204.0.0/16 Network 15.204.241.0-15.204.241.255 First seen 2026-06-03T01:00:47Z Last seen 2026-11-11T16:19:52Z

3.222.148.169

US communicates

CIDR 3.208.0.0/12 Network 3.208.0.0-3.223.255.255 First seen 2024-08-31T11:19:33Z Last seen 2026-11-11T20:01:45Z

44.217.253.46

0% US communicates

CIDR 44.192.0.0/11 Network 44.192.0.0-44.223.255.255 First seen 2024-11-25T08:35:23Z Last seen 2026-11-11T20:01:45Z

35.169.106.28

5% low US communicates

CIDR 35.168.0.0/13 Network 35.152.0.0-35.183.255.255 First seen 2024-05-04T06:09:39Z Last seen 2026-11-11T20:01:45Z

162.159.36.2

0% US communicates

CIDR 162.159.0.0/18 Network 162.158.0.0-162.159.255.255 First seen 2023-09-30T16:06:22Z Last seen 2026-11-11T20:19:01Z

Related domains

Domains associated with this indicator.

3shown

instance-idqrcl-relay.screenconnect.com

.com communicates

Root screenconnect.com TLD com Subdomain instance-idqrcl-relay First seen 2026-03-13T14:13:04Z Last seen 2026-11-11T00:37:20Z

check.screenconnect.com

0% .com communicates

Root screenconnect.com TLD com Subdomain check First seen 2023-10-01T14:51:48Z Last seen 2026-11-11T20:02:20Z

screenconnect.com

0% .com communicates

Root screenconnect.com TLD com First seen 2023-10-01T11:49:10Z Last seen 2026-11-11T20:02:20Z

Related URLs

URLs associated with this indicator.

1shown

https://check.screenconnect.com/InstallerOriginInfo.axd

0% communicates

TLD com HTTP status 200 First seen 2026-02-27T03:09:48Z Last seen 2026-11-11T20:02:20Z

Analysis details

Severity: highhacktoolexefile-overlaypersistencewmi-activityobfuscatedadapter-discoverydebug-checkexec-delayconnectwisepuasigned

Freshness: Fresh · Last seen today.

Detection rate: 17%
Threat type: hacktool
Family: connectwise
Confidence: 92%
confidence: 92 · VirusSign confidence; engine detections are reported separately.

Overview

SHA256: 6e80cf0dc0bc2ffbb82b258246aadad44356dfc3b17f54a7091b6d060ee4091d
SHA1: f7942088103a877441839f4bca791243c9953a81
MD5: 0f01f5e2886a4be432d5a4f9fd1f93bb
Filename: ScreenConnect.ClientSetup.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
File size: 12846648
Compile time: 2022-11-18T20:10:20Z
PE platform: x86 32-bit
PE sections: 5
Import libraries: 3
TLSH: T161D61210B3E692B9E1BF0678D83AA2655A75BC054752C3EF53947D692D32BC08B313B3
SSDEEP: 196608:pmfefPxMOo/K6Sdr3tBiCFKpj10ZMOo/K6Sdr3t+MOo/K6Sdr3ttMOo/K6Sdr3tS:byK6c/1K70ZyK6cUyK6cDyK6cM
Imphash: 9771ee6344923fa220489ab01239bdfd
Richhash: a498773e40e07b36d0f4a2dab1633f09
First seen: 2026-11-10T21:39:02Z
Last seen: 2026-11-11T00:37:20Z

Key findings

A focused interpretation of the evidence, relationships and observation history that matter most.

Analysis takeaway

High-confidence evidence. Related indicators in this report: 14. Review the supporting evidence before taking action.

Detection signal

Malicious. A limited set of engine detections is present (17%).

Confidence signal

VirusSign reports 92% confidence. Review this alongside engine detections and relationship evidence.

Threat context

Classification includes type hacktool and family connectwise.

Relationship context

14 related indicators are shown across 4 relationship group(s). Additional relationship intelligence is available through API and data access.

Observation timeline

15 timestamped observations are arranged from 2012-12-24 to 2076-08-11. These are observation or metadata times, not execution order.

Why this verdict

Review the reported detections, analysis confidence and supporting context.

evidence

VirusSign reports high analysis confidence alongside a low or unreported engine detection rate. These are different measures; review the supporting classification and relationships.

Engine detections 17%

Reported engine detection rate. A low rate alone does not establish that the indicator is benign.

VirusSign confidence 92%

VirusSign analysis confidence; separate from detection rate and actor-association confidence.

Relationship context 14 visible

4 relationship group(s) provide pivot and infrastructure context.

Threat classification connectwise

Classification context: type hacktool, family connectwise.

Intelligence freshness Fresh

Last seen today.

Signals reflect the intelligence returned in this report. Missing values mean not reported, not zero. Related indicators are investigation leads, not proof of shared malicious activity.

File profile

summary

Selected file intelligence summary.

Filename: ScreenConnect.ClientSetup.exe
File type: peexe
MIME: application/vnd.microsoft.portable-executable
Size: 12846648
Compile time: 2022-11-18T20:10:20Z
PE platform: x86 32-bit
Entry point: 5293
Sections: 5

Observed behavior

selected details

Selected behavioral observations and reported framework mappings.

wmi-activityadapter-discoverydebug-checkexec-delayobfuscatedpersistence

View details · 5 shown

A DLL was loaded from a suspicious directory
A named pipe was used for inter-process communication
Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Allocates memory with a write watch (potentially for evading sandboxes)
Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching

5 shown

View MITRE ATT&CK details · 5 shown

T1574 — A DLL was loaded from a suspicious directory
Tactics: TA0002 · TA0005
T1071 — A named pipe was used for inter-process communication
Tactics: TA0011
T1027 · T1055 — Allocated memory and changed its protection to PAGE_NOACCESS, may be used to hide payloads from memory scanners or to trigger an access violation for exception-driven execution
Tactics: TA0004 · TA0005
T1497 — Allocates memory with a write watch (potentially for evading sandboxes)
Tactics: TA0005 · TA0007
T1055 — Altered memory protections from dynamically allocated (unbacked) memory, indicative of self-modifying shellcode or memory patching
Tactics: TA0004 · TA0005

5 shown

View MBC details · 5 shown

Anti-Behavioral Analysis
Objectives: OB0001
Anti-Static Analysis
Objectives: OB0002
B0001.002 — CheckRemoteDebuggerPresent
Objectives: OB0001
Communication
Objectives: OC0006
C0060 — Compression Library
Objectives: OC0004

5 shown

Network activity

selected details

Selected observations and details. Additional structured data are available through API and data access.

Network activity5

HTTP, TCP, UDPports 443, 53

5 outbound connections observed
1 domains, 3 IPs, 1 URLs
Common ports: 443, 53
Protocols: HTTP, TCP, UDP

View details · 4 shown

Domain: check.screenconnect.com
URL: https://check.screenconnect.com/installerorigininfo.axd
Protocol: HTTP

IP: 44.217.253.46
Port: 443
Protocol: TCP

IP: 162.159.36.2
Port: 53
Protocol: UDP

IP: 15.204.241.181
Port: 443
Protocol: TCP

DNS request activity2

A4 response IPs

2 DNS requests observed
2 unique queries
4 response IPs
Query types: A
Response codes: NOERROR

View details · 2 shown

Query: instance-idqrcl-relay.screenconnect.com
Type: A
Answers: 15.204.241.181
Response: NOERROR

Query: check.screenconnect.com
Type: A
Answers: 44.217.253.46, 35.169.106.28, 3.222.148.169
Response: NOERROR

File structure

selected details

Selected observations and details. Additional structured data are available through API and data access.

PE header1

platform x86 32-bit5 sections

Platform: x86 32-bit
Sections: 5
Entry point: present
Compile time: 2022-11-18T20:10:20Z

View details · 1 shown

Platform: x86 32-bit
Entry point: 5293
Sections: 5
Compile time: 2022-11-18T20:10:20Z

PE sections5

5 sections

5 PE sections
Common permissions: r, rw, rx
5 unique section names

View details · 5 shown

Name: .text
Virtual address: 4096
Virtual size: 45487
Raw size: 45568
Permissions: rx
Entropy: 6.59

Name: .rdata
Virtual address: 53248
Virtual size: 24696
Raw size: 25088
Permissions: r
Entropy: 4.79

Name: .data
Virtual address: 81920
Virtual size: 4580
Raw size: 2048
Permissions: rw
Entropy: 2.27

Name: .rsrc
Virtual address: 90112
Virtual size: 12762648
Raw size: 12763136
Permissions: r
Entropy: 7.81

Name: .reloc
Virtual address: 12853248
Virtual size: 3752
Raw size: 4096
Permissions: r
Entropy: 6.3

Imports3

3 DLL groups

3 import DLL groups
5+ imported functions summarized

View details · 3 shown

Library: mscoree.dll
Functions: CorBindToRuntimeEx

Library: KERNEL32.dll
Functions: CloseHandle, CreateFileW, DecodePointer, DeleteCriticalSection, EncodePointer, EnterCriticalSection, ExitProcess, FindClose …

Library: OLEAUT32.dll
Functions: SafeArrayAccessData, SafeArrayCreateVector, SafeArrayDestroy, SafeArrayUnaccessData, VariantClear, VariantInit

Resources5+

5+ resources

5+ resources
Resource types: FILES, RT_MANIFEST, RT_RCDATA, RT_VERSION

View details · 4 shown

Type: FILES
Language: NEUTRAL

Type: RT_RCDATA
Language: NEUTRAL

Type: RT_VERSION
Language: ENGLISH US

Type: RT_MANIFEST
Language: ENGLISH US

File certificate

selected details

Selected observations and details. Additional structured data are available through API and data access.

Certificates5+

4 issuers

Example subject: ConnectWise, LLC
Issued by: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Validity period (UTC): 2026-02-20 – 2027-02-19

View details · 5 shown

Subject: ConnectWise, LLC
Issuer: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Valid from: 1771545600.0
Valid to: 1803081540.0
Fingerprint: C1603341F3EB5AF6A5601C90CF8937EDC06D54E7

Subject: DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1
Issuer: DigiCert Trusted Root G4
Valid from: 1619654400.0
Valid to: 2093039940.0
Fingerprint: 7B0F360B775F76C94A12CA48445AA2D2A875701C

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Trusted Root G4
Valid from: 1375358400.0
Valid to: 2147169600.0
Fingerprint: DDFB16CD4931C973A2037D3FC83A4D7D775D05E4

Subject: DigiCert Trusted Root G4
Issuer: DigiCert Assured ID Root CA
Fingerprint: A99D5B79E9F1CDA59CDAB6373169D5353F5874C6

Subject: DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1
Issuer: DigiCert Trusted Root G4
Fingerprint: 07894D00FC194A17DB273AEB5CF8FACEF14423A4

5 shown

Files are hashed locally in your browser and never uploaded. Only the SHA-256 is sent for lookup. Standard query quota applies.

Appearance

Indicator overview

Connected context

Key findings

Analysis signals

No observations in this view

Visible connections

Related intelligence

Dropped / child files

Related IPs

Related domains

Related URLs

Analysis details

Overview

Key findings

Why this verdict

File profile

Observed behavior

Network activity

File structure

File certificate

Explore further connections

Structured report export

Explore more details

Put this intelligence to work

A quick security check