A file named ScreenConnect Patcher V3.exe has appeared in malware-analysis databases, and the results aren't encouraging.
A recent Hybrid Analysis submission classified the Windows executable as malicious, assigning it a threat score of 64/100 and reporting 179 indicators. The analyzed file has the SHA-256 hash:
61fe6cc6710a8d2c605883134afbd61705ea0d0f1cecd71d6fe04b152f2703c9
The same hash appeared in an earlier Hybrid Analysis report that also classified the executable as malicious. Hybrid Analysis
The important distinction is that this isn't evidence that legitimate ConnectWise ScreenConnect software is malware. The analyzed executable is a third-party file calling itself a “Patcher.”
It's another good example of why unofficial patches, cracks, and modified installers should be treated as untrusted executables regardless of what familiar product name appears in the filename.
A recent Hybrid Analysis submission classified the Windows executable as malicious, assigning it a threat score of 64/100 and reporting 179 indicators. The analyzed file has the SHA-256 hash:
61fe6cc6710a8d2c605883134afbd61705ea0d0f1cecd71d6fe04b152f2703c9
The same hash appeared in an earlier Hybrid Analysis report that also classified the executable as malicious. Hybrid Analysis
The important distinction is that this isn't evidence that legitimate ConnectWise ScreenConnect software is malware. The analyzed executable is a third-party file calling itself a “Patcher.”
It's another good example of why unofficial patches, cracks, and modified installers should be treated as untrusted executables regardless of what familiar product name appears in the filename.