{"id":"f90b80b035acae48cad08d8d2bb3ff0b","title":"ScreenConnect 武器化 — ScreenConnect 武器化 · 木马/恶意软件 · PE32","md5":"f90b80b035acae48cad08d8d2bb3ff0b","sha256":"031dcce29761f42a1b40767b358b18d70e8745b233dd21f6f673b7b45b5a60b4","family":"ScreenConnect 武器化","apt":null,"verdict":null,"sample_type":"木马/恶意软件","lang":"未知","file_format":"PE32","compiler":"Unknown","published_at":"2026-08-09T16:00:00.000Z","summary":"该样本是一个 Rust 编译的 PE32 加载器，内嵌 5 个 .NET 程序集（4 DLL + 1 EXE），用于部署 ScreenConnect（ConnectWise Control）远程访问工具。提取的载荷经确认为 ScreenConnect 客户端安装器组件（ScreenConnect.ClientSetup.msi、InstallerActions 等），属于典型的合法远程管理工具被武器化利用（RAT abuse）。样本导入 mscoree.dll!CorBindToRuntimeEx 以加载 CLR 运行时执行 .NET 载荷。","url":"https://zseceye.com/report/f90b80b035acae48cad08d8d2bb3ff0b","json_url":"https://zseceye.com/report/f90b80b035acae48cad08d8d2bb3ff0b.json","html_url":"https://zseceye.com/report/f90b80b035acae48cad08d8d2bb3ff0b","hash_urls":{"md5":"https://zseceye.com/hash/f90b80b035acae48cad08d8d2bb3ff0b","sha256":"https://zseceye.com/hash/031dcce29761f42a1b40767b358b18d70e8745b233dd21f6f673b7b45b5a60b4"},"search_urls":{"md5":"https://zseceye.com/?q=f90b80b035acae48cad08d8d2bb3ff0b","sha256":"https://zseceye.com/?q=031dcce29761f42a1b40767b358b18d70e8745b233dd21f6f673b7b45b5a60b4"},"sample_download_url":"https://zseceye.com/report/f90b80b035acae48cad08d8d2bb3ff0b/sample","sample_filename":"031dcce29761f42a.zip","iocs":[],"ips":[]}