MB-7e3a7aaf0272931c81fa37dc1086c10641956f9c542c26128c7d410d3dac61df
high
📛 Threat Title
ConnectWise: support.client.exe
Description
File type: exe. Size: 312560 bytes. Tags: ConnectWise, signed. Reporter: BlinkzSec. First seen: 2026-05-13 18:48:18.
Indicators of Compromise (5)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
support.client.exe
VT: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/support.client.exe
IOC database
- Type
- domain
- Value
support.client.exe- First seen
- Last seen
- Attached to this threat
- Appears in
- 10 threats
- Description
- Extracted from Threat MB-d9fbcad42aaf846845c6c04550e5c010903112eedccd901c43c0a7a9be1bf2eb
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Too Many Requests for domains/support.client.exe
hash_imphash
c2fe6927e1db8cf00400dbef9e5d35be
IOC database
- Type
- hash_imphash
- Value
c2fe6927e1db8cf00400dbef9e5d35be- First seen
- Last seen
- Attached to this threat
- Appears in
- 159 threats
- Description
- imphash of URLhaus payload 75b337e70eed4a26…
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha256
7e3a7aaf0272931c81fa37dc1086c10641956f9c542c26128c7d410d3dac61df
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/7e3a7aaf0272931c81fa37dc1086c10641956f9c542c26128c7d410d3dac61df
1 feed
IOC database
- Type
- hash_sha256
- Value
7e3a7aaf0272931c81fa37dc1086c10641956f9c542c26128c7d410d3dac61df- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- ConnectWise
Threat Hunt — feed corroboration
Listed by 1 threat-intel feed vendor: Abuse.ch. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/7e3a7aaf0272931c81fa37dc1086c10641956f9c542c26128c7d410d3dac61df
hash_sha1
bfef90d47201537f396f896897b7a6286abd49f3
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/bfef90d47201537f396f896897b7a6286abd49f3
2 feeds
IOC database
- Type
- hash_sha1
- Value
bfef90d47201537f396f896897b7a6286abd49f3- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/bfef90d47201537f396f896897b7a6286abd49f3
hash_md5
b4fbbed84311d330406e2a6f6a99341e
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/b4fbbed84311d330406e2a6f6a99341e
2 feeds
IOC database
- Type
- hash_md5
- Value
b4fbbed84311d330406e2a6f6a99341e- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
Threat Hunt — feed corroboration
Listed by 2 threat-intel feed vendors: Abuse.ch, threatview.io. Open in Threat Hunt →
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/files/b4fbbed84311d330406e2a6f6a99341e
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 312560 bytes. Tags: ConnectWise, signed. Reporter: BlinkzSec. First seen: 2026-05-13 18:48:18.
Remediations (10)
-
web:blog.gdatasoftware.com
Since March 2025, there has been a noticeable increase in infections and fake applications using validly signed ConnectWise samples. We reveal how bad signing practices allow threat actors to abuse this legitimate software to build and distribute their own signed malware and what security vendors can do to detect them.
-
web:cloud.google.com
For organizations with a cloud-based controller, no action is required as ConnectWise has applied the necessary patches. For organizations with an on-premises controller, Mandiant is providing a remediation and hardening guide for additional steps to reduce risks related to these vulnerabilities.
-
web:netwerklabs.com
On February 19, 2024 ConnectWise disclosed two vulnerabilities in their ScreenConnect remote access software. Both vulnerabilities affect ScreenConnect 23.9.7 and earlier.
-
web:services.google.com
Summary This document contains remediation and hardening recommendations for responding to critical vulnerabilites for the ConnectWise ScreenConnect application announced on February 19, 2024.
-
web:steveit.ca
Scam Remote In Hidden remote software with support.client.exe Had a few clients that got scammed for people to remote into their PC. Indication that its a scam is when they have a support.client.exe file in their download folder. What this does is installs ConnectWise screenconnect service.
-
web:success.trendmicro.com
On Tuesday, February 13th, ConnectWise disclosed (2) vulnerabilities - CVE-2024-1708 & CVE-2024-1709 - in their ScreenConnect remote desktop and access product, including one a critical CVSS 10, impacting versions 23.9.7 and prior. On Wednesday, February 21st, ConnectWise released version 23.9.8, recommending all on-premise customers to update to this version as soon as possible in order to ...
-
web:sunilgentyala.substack.com
Mitigation Framework Immediate Remediation Actions RMM Client Access Controls: Enforce strict application allowlisting and digital signature validation for all RMM client installations, prohibit unapproved ScreenConnect client pairing operations, and implement application control policies preventing execution of unsigned installers.
-
web:www.connectwise.com
Remediation efforts for ConnectWise PSA™ are ongoing. In the meantime, we recommend using the web client instead of the thick client to reduce exposure risk Reports and Dashboards (formerly BrightGauge™), SmileBack™, ConnectWise CPQ™, ConnectWise Automate™, Asio™ platform, and security services are not directly impacted
-
web:www.cyberproof.com
Further investigations led to collection of possible related IOCs, one is a malicious webpage [www.helpw8.top] impersonating customer support leading to download and execution of malicious dropper using file name Support.Client (1).exe.
-
web:www.reddit.com
When inspecting the computer, I see a file named support.Client.exe as well as what looks like a full installation of Screen Connect within the app data folder. The installation time of Screen Connect appears to coincide with the time that my family member was in a call with the scammmers.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.