ScreenConnect[.]ClientSetup3[.]exe

General

Target
ScreenConnect.ClientSetup3.exe
Size 19.6MB
Sample260605-tynblaa151
SHA256 bad74be50095a57403a321324ec8c28f536bef2e573090570b4a8abad58ea0e9
MD5 2f56c9bfe1a1e7e51092dc14a6abc22f
SHA1 02867d317c8e2d727904facf3dbb37acd784a1f4
SHA512 99265d61890aacb721c98a3c0efa7452c7fe8de65fd406658bc0fef47ff98cdef0afb975b7d5ba7196f13f55a5b3037ad29162703018e9c6b6be784cf9d9d1c0
SSDEEP 393216:khmOvTi7hha62A3N11qOvTi7hha62rOvTi7hha62UOvTi7hha62s:khmOvjA371qOvjrOvjUOvjs
TLSH
T1B02723017BC6AAA7D43F0635987A632067B4BC414F13C36F66A47A3D1D327C06E727A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

ScreenConnect.ClientSetup3.exe

.exe 19.6MB

ScreenConnect.ClientSetup3.exe

IMPHASH 9771ee6344923fa220489ab01239bdfd
SHA256 bad74be50095a57403a321324ec8c28f536bef2e573090570b4a8abad58ea0e9
MD5 2f56c9bfe1a1e7e51092dc14a6abc22f
SHA1 02867d317c8e2d727904facf3dbb37acd784a1f4
SHA512 99265d61890aacb721c98a3c0efa7452c7fe8de65fd406658bc0fef47ff98cdef0afb975b7d5ba7196f13f55a5b3037ad29162703018e9c6b6be784cf9d9d1c0
SSDEEP 393216:khmOvTi7hha62A3N11qOvTi7hha62rOvTi7hha62UOvTi7hha62s:khmOvjA371qOvjrOvjUOvjs
TLSH
T1B02723017BC6AAA7D43F0635987A632067B4BC414F13C36F66A47A3D1D327C06E727A6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Digest

01:71:9a:2c:bb:d2:64:65:40:36:67:ef:35:46:f4:96:b9:a1:af:e3:c3:b7:88:dc:cf:5a:04:e9:94:79:af:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US

Chains

Jun 4, 2026

CN=ConnectWise\, LLC,O=ConnectWise\, LLC,L=Tampa,ST=Florida,C=US

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Minor OS version

1

Major OS version

5

Entry point

5293

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb

mscoree

CorBindToRuntimeEx

kernel32

GetModuleFileNameA DecodePointer SizeofResource LockResource LoadLibraryW LoadResource FindResourceW GetProcAddress WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RaiseException GetStdHandle WriteFile CreateFileW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP CloseHandle HeapAlloc HeapFree FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap

oleaut32

VariantInit SafeArrayUnaccessData SafeArrayCreateVector SafeArrayDestroy VariantClear SafeArrayAccessData

Sharing