MALICIOUS — 226d96500e4ca936191cbfa466e673130fcd0d9fa5c886067d837cb44856b560.exe
MALICIOUS — 226d96500e4ca936191cbfa466e673130fcd0d9fa5c886067d837cb44856b560.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (83/100), attributed to the ConnectWise family. 3 of 52 detection engines flagged it.
Identification
- SHA-256:
226d96500e4ca936191cbfa466e673130fcd0d9fa5c886067d837cb44856b560 - SHA-1:
28af9a5bcfa86426fd4f77313bdb3ce1033410bd - MD5:
63b7edc9bec5b43b3f012abf34e6c8f7 - imphash:
c2fe6927e1db8cf00400dbef9e5d35be - ssdeep:
6144:amlfAgiw7Op5ryNkS7Z12wvtGVG3iVt8eZ1u2J/xFji9:p1iw7gryNkSV1hy1Z1u2JLu9 - TLSH:
T1A84649C95300A351EDBA8BA03E816D2F25E7F89AE2FD1C5D4783812F77B5487E00519A - Submitted as: 226d96500e4ca936191cbfa466e673130fcd0d9fa5c886067d837cb44856b560.exe
- File type: pe · Size: 312536 bytes
- Verdict: malicious (83/100) · Family: ConnectWise
Source: MalwareBazaar · first seen 2026-08-01T00:00:00.000Z · SHA-256 verified
Detections (3 of 52 engines)
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win32/Malgent
- Kaspersky (KVRT): not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen
Why this verdict
The malicious score of 83/100 is the fusion of 4 weighted signals:
- Microsoft Defender flagged Trojan:Win32/Malgent (rule
Trojan:Win32/Malgent) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen (rule
not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen) - engine signal, weight 0.55, confidence 0.85 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://45.88.186.163/Bin/ScreenConnect.Client.application?h=45.88.186.163&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQBNWyTuO80spCMgsSSNjt06pJSQnUjyttCzdd8TqAsTQ0JzLzTShuGoJxYmyqMNIfe%2fwlcrbvh2no%2f14z7YHEzktUwncj9td2lk7QI2h9RdLtDDpBKSGTIwWJ0l7B4mYJqFr3DhCesiVsjFNx4DHtA4DMOC4e4noRRRCSLEWMDzU6LWhW%2bhp8jw7eVjNFZFtAHMSvXPxBP6AKaPv4tn7hKNMyI8PjKWT5XfZPVd%2bshWsko4xowSvK0H1PeFpAxrFihfLZfg8pOP2E%2bVNDoRs39lvWiWvsTca4qYbTtXSxudPTzMz3J5MlmbSw1LjcB4qVWG%2bEdr4%2bxvsCkkntKlF52f, 45.88.186.163 - static signal, weight 0.35, confidence 0.60
Dynamic analysis (windows)
0 behavior events · 0 ATT&CK techniques · 0 dropped files.
Runtime network
- none
Embedded URLs
- http://www.digicert.com/CPS0
- https://45.88.186.163/Bin/ScreenConnect.Client.application?h=45.88.186.163&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQBNWyTuO80spCMgsSSNjt06pJSQnUjyttCzdd8TqAsTQ0JzLzTShuGoJxYmyqMNIfe%2fwlcrbvh2no%2f14z7YHEzktUwncj9td2lk7QI2h9RdLtDDpBKSGTIwWJ0l7B4mYJqFr3DhCesiVsjFNx4DHtA4DMOC4e4noRRRCSLEWMDzU6LWhW%2bhp8jw7eVjNFZFtAHMSvXPxBP6AKaPv4tn7hKNMyI8PjKWT5XfZPVd%2bshWsko4xowSvK0H1PeFpAxrFihfLZfg8pOP2E%2bVNDoRs39lvWiWvsTca4qYbTtXSxudPTzMz3J5MlmbSw1LjcB4qVWG%2bEdr4%2bxvsCkkntKlF52f
Embedded domains
- cacerts.digicert.com
- crl3.digicert.com
- crl4.digicert.com
- www.digicert.com
Embedded IP addresses
- 45.88.186.163
File paths
- C:\builds\cc\cwcontrol\Product\ClickOnceRunner\Release\ClickOnceRunner.pdb
More ConnectWise samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report