{"id":"8fdc8eb2b0739cdea9e5559342cf9152","title":"ConnectWise Control — ConnectWise Control · 木马/恶意软件 · PE32","md5":"8fdc8eb2b0739cdea9e5559342cf9152","sha256":"12411713c6d011f83666bd855708a673e8f3d98e3b9555a3cc10857a74e47a58","family":"ConnectWise Control","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"Rust","file_format":"PE32","compiler":"Rust","published_at":"2026-08-05T16:00:00.000Z","summary":"该样本为 ConnectWise Control（ScreenConnect）的 ClickOnce 部署启动器，使用 Rust 语言编译（i686-pc-windows-msvc），经 DigiCert 颁发给 Connectwise, LLC 的数字签名认证。ConnectWise Control 是一款合法的企业级远程桌面和支持工具，广泛应用于 MSP（托管服务提供商）行业。然而，该工具常被网络犯罪分子和 APT 组织滥用于建立持久远程访问、横向移动和数据窃取。 静态分析结果显示：样本通过 PEB 访问实现调试器检测，使用 GetLocaleInfo 获取系统区域信息，具备文件枚举和写入能力，运行时动态链接 Windows API。未发现恶意代码注入、凭证窃取、键盘记录等恶意行为特征。 综合判断：该样本为 ConnectWise Control 的合法、未修改版本。其出现在 MalwareBazaar 的原因可能为：攻击者在实际入侵中使用了该工具，导致安全厂商将其哈希值标记为恶意。建议结合网络流量和部署上下文进行综合研判。","url":"https://zseceye.com/report/8fdc8eb2b0739cdea9e5559342cf9152","json_url":"https://zseceye.com/report/8fdc8eb2b0739cdea9e5559342cf9152.json","html_url":"https://zseceye.com/report/8fdc8eb2b0739cdea9e5559342cf9152","hash_urls":{"md5":"https://zseceye.com/hash/8fdc8eb2b0739cdea9e5559342cf9152","sha256":"https://zseceye.com/hash/12411713c6d011f83666bd855708a673e8f3d98e3b9555a3cc10857a74e47a58"},"search_urls":{"md5":"https://zseceye.com/?q=8fdc8eb2b0739cdea9e5559342cf9152","sha256":"https://zseceye.com/?q=12411713c6d011f83666bd855708a673e8f3d98e3b9555a3cc10857a74e47a58"},"sample_download_url":"https://zseceye.com/report/8fdc8eb2b0739cdea9e5559342cf9152/sample","sample_filename":"12411713.zip","iocs":[],"ips":[]}