MB-eebad34642be1e5256c715ab3746d4a67a7d3ee8685b6055a0f1a45744ce9e56
high
📛 Threat Title
Unknown: ScreenConnect.ClientSetup.exe
Description
File type: exe. Size: 5643328 bytes. Tags: signed. Reporter: BlinkzSec. First seen: 2026-05-14 12:52:45.
Indicators of Compromise (5)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
screenconnect.clientsetup.exe
VT: VT base fetch failed: SSLError: HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /api/v3/domains/screenconnect.clientsetup.exe (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate is not yet valid (_ssl.c:992)')))
IOC database
- Type
- domain
- Value
screenconnect.clientsetup.exe- First seen
- Last seen
- Attached to this threat
- Appears in
- 9 threats
- Description
- Extracted from Threat MB-efc4186e35021b6367b40de3f875038d045ea89b9e3408e2955fdc7c87d48595
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: SSLError: HTTPSConnectionPool(host='www.virustotal.com', port=443): Max retries exceeded with url: /api/v3/domains/screenconnect.clientsetup.exe (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate is not yet valid (_ssl.c:992)')))
hash_imphash
9771ee6344923fa220489ab01239bdfd
IOC database
- Type
- hash_imphash
- Value
9771ee6344923fa220489ab01239bdfd- First seen
- Last seen
- Attached to this threat
- Appears in
- 145 threats
- Description
- imphash of URLhaus payload 997a09b5cbbebd7e…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
eebad34642be1e5256c715ab3746d4a67a7d3ee8685b6055a0f1a45744ce9e56
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for files/eebad34642be1e5256c715ab3746d4a67a7d3ee8685b6055a0f1a45744ce9e56
1 feed
IOC database
- Type
- hash_sha256
- Value
eebad34642be1e5256c715ab3746d4a67a7d3ee8685b6055a0f1a45744ce9e56- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- Unknown
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for files/eebad34642be1e5256c715ab3746d4a67a7d3ee8685b6055a0f1a45744ce9e56
hash_sha1
636a711ff3e12a005d887836e102ee0018e13e6f
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/636a711ff3e12a005d887836e102ee0018e13e6f
2 feeds
IOC database
- Type
- hash_sha1
- Value
636a711ff3e12a005d887836e102ee0018e13e6f- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/636a711ff3e12a005d887836e102ee0018e13e6f
hash_md5
ae25fdcf724759caa27a5221bebb246b
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/ae25fdcf724759caa27a5221bebb246b
2 feeds
IOC database
- Type
- hash_md5
- Value
ae25fdcf724759caa27a5221bebb246b- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/ae25fdcf724759caa27a5221bebb246b
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 5643328 bytes. Tags: signed. Reporter: BlinkzSec. First seen: 2026-05-14 12:52:45.
Remediations (10)
-
web:cybersecuritynews.com
Memory-only artifacts, such as live chat transcripts and session logs, reside solely in process heaps, necessitating volatile memory capture for forensic recovery. By combining in-memory execution, custom-config builders, and encrypted launch keys, threat actors transform a legitimate RMM solution into a stealthy remote access Trojan, complicating detection and incident response for security ...
-
web:learn.microsoft.com
I was almost scammed, I dialed number from a Google serarch, that indicated it was a live Microsoft person who than downloaded a software ScreenConnet. Once I realized I wasn't speaking with a Microsoft person I hung up. I can't get ScreenConnet to…
-
web:services.google.com
Summary This document contains remediation and hardening recommendations for responding to critical vulnerabilites for the ConnectWise ScreenConnect application announced on February 19, 2024.
-
web:www.acronis.com
Over the past months, Acronis TRU (Threat Research Unit) has identified multiple active and ongoing campaigns leveraging trojanized versions of ConnectWise ScreenConnect to gain initial access to victim networks and compromise target machines.
-
web:www.bleepingcomputer.com
Page 1 of 2 - ScreenConnect scam - posted in Virus, Trojan, Spyware, and Malware Removal Help: A family member brought me her computer after she fell for a phishing scam. She received an email ...
-
web:www.connectwise.com
On-prem partners are advised to immediately upgrade to the latest version of ScreenConnect to remediate against reported vulnerabilities. Active maintenance If you are on active maintenance, we strongly recommend upgrading to the most current release of 23.9.8 or later. Using the most current release of ScreenConnect includes security updates, bug fixes, and enhancements not found in older ...
-
web:www.forcepoint.com
Hackers weaponize ScreenConnect to bypass SmartScreen, remove MOTW and gain access. X-Labs breaks down the attack chain and key mitigations .
-
web:www.infosecurity-magazine.com
A rise in cyber-attacks exploiting remote monitoring and management (RMM) tools for initial access via phishing has been observed by cybersecurity researchers. According to the new findings from the DarkAtlas research project, advanced persistent threat (APT) groups are abusing popular RMM platforms, including AnyDesk, ConnectWise ScreenConnect and Atera, to gain unauthorized control of ...
-
web:www.malwarebytes.com
Fake party invitations are used to install remote access tools, so the criminals are the ones invited.
-
web:www.pcrisk.com
What is ScreenConnect (ConnectWise) Client scam? Fraudsters use all kinds of ways to extract information or money from people and distribute malicious programs via emails. This article describes cases where fraudsters use emails to trick recipients into installing ConnectWise (formerly known as ScreenConnect). This software allows threat actors to perform malicious activities on computers. The ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.