MB-c5cab4e8643d9494801477fa620c929835fa256f6b2806847f2a9e50e31da3c5
high
📛 Threat Title
ConnectWise: ScreenConnect.ClientSetup.exe
Description
File type: exe. Size: 5686928 bytes. Tags: ConnectWise, signed. Reporter: BlinkzSec. First seen: 2026-05-13 18:48:28.
Indicators of Compromise (5)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
screenconnect.clientsetup.exe
VT: VT base fetch failed: SSLError: HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /api/v3/domains/screenconnect.clientsetup.exe (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate is not yet valid (_ssl.c:992)')))
IOC database
- Type
- domain
- Value
screenconnect.clientsetup.exe- First seen
- Last seen
- Attached to this threat
- Appears in
- 9 threats
- Description
- Extracted from Threat MB-efc4186e35021b6367b40de3f875038d045ea89b9e3408e2955fdc7c87d48595
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: SSLError: HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /api/v3/domains/screenconnect.clientsetup.exe (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate is not yet valid (_ssl.c:992)')))
hash_imphash
9771ee6344923fa220489ab01239bdfd
IOC database
- Type
- hash_imphash
- Value
9771ee6344923fa220489ab01239bdfd- First seen
- Last seen
- Attached to this threat
- Appears in
- 144 threats
- Description
- imphash of URLhaus payload 997a09b5cbbebd7e…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
c5cab4e8643d9494801477fa620c929835fa256f6b2806847f2a9e50e31da3c5
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/c5cab4e8643d9494801477fa620c929835fa256f6b2806847f2a9e50e31da3c5
1 feed
IOC database
- Type
- hash_sha256
- Value
c5cab4e8643d9494801477fa620c929835fa256f6b2806847f2a9e50e31da3c5- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- ConnectWise
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/c5cab4e8643d9494801477fa620c929835fa256f6b2806847f2a9e50e31da3c5
hash_sha1
06bef2d6347237fbd8a61280911458a4cff29b90
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/06bef2d6347237fbd8a61280911458a4cff29b90
2 feeds
IOC database
- Type
- hash_sha1
- Value
06bef2d6347237fbd8a61280911458a4cff29b90- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/06bef2d6347237fbd8a61280911458a4cff29b90
hash_md5
24ba3f5ea6f1d5c5454ec81d91ad45a4
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/24ba3f5ea6f1d5c5454ec81d91ad45a4
2 feeds
IOC database
- Type
- hash_md5
- Value
24ba3f5ea6f1d5c5454ec81d91ad45a4- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/24ba3f5ea6f1d5c5454ec81d91ad45a4
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 5686928 bytes. Tags: ConnectWise, signed. Reporter: BlinkzSec. First seen: 2026-05-13 18:48:28.
Remediations (10)
-
web:cyberpress.org
Escalate privileges to gain domain-level control Given the role of ScreenConnect in managed service provider (MSP) environments, exploitation could also enable supply chain-style attacks, impacting multiple downstream clients. Mitigation Deadlines and CISA Directive CISA has mandated that federal agencies remediate the vulnerability by May 12 ...
-
web:docs.connectwise.com
Introduction After building an access agent installer, you will need run it one or more machines in order to connect to them from the Host page. This page will describe how to install a ScreenConnect™ access agent.
-
web:services.google.com
Summary This document contains remediation and hardening recommendations for responding to critical vulnerabilites for the ConnectWise ScreenConnect application announced on February 19, 2024.
-
web:socprime.com
Installation: The VBS script silently launches msiexec.exe to install the ScreenConnect.ClientSetup.msi with /quiet. This creates a new process creation event whose Image ends with ScreenConnect.ClientSetup.msi, satisfying the rule condition.
-
web:www.acronis.com
Over the past months, Acronis TRU (Threat Research Unit) has identified multiple active and ongoing campaigns leveraging trojanized versions of ConnectWise ScreenConnect to gain initial access to victim networks and compromise target machines.
-
web:www.bleepingcomputer.com
Threat actors are abusing the ConnectWise ScreenConnect installer to build signed remote access malware by modifying hidden settings within the client's Authenticode signature.
-
web:www.forcepoint.com
ScreenConnect.ClientService.exe is a part of the ScreenConnect tool made by ConnectWise . It runs in the background and allows someone to remotely access or control your computer for support or meetings.
-
web:www.microsoft.com
Signed malware backed by a stolen EV certificate deployed legitimate RMM tools to gain persistent access inside enterprise environments. Organizations must harden certificate controls and monitor RMM activity to reduce exposure.
-
web:www.reddit.com
There are no Connectwise services, nothing in add/remove programs, no program files/data, and yet I still get the same message. I don't know the thumbprint of the original client install (was not documented by my predecessor).
-
web:www.screenconnect.com
Each release is a full-server installation of ScreenConnect, which include client components. Mobile clients can be downloaded from the appropriate app store.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.