Fake Bitcoin-wallet installer delivering an unattended ScreenConnect (ConnectWise Control) backdoor, screened behind a genuine signed DocuSign installer.
| Classification | Dropper / initial-access implant — RMM abuse (T1219) |
| Severity | Critical — full unattended SYSTEM-level remote control, LSA-resident code |
| Analysis date | 2026-09-01 |
| Analysis type | Static only. Sample never executed (Windows batch, examined on macOS) |
| Target platform | Windows (all supported versions; requires .NET 4.x for decoy) |
| Delivery | Downloaded from a malicious website posing as Specter Desktop distribution |
Note on contents: this report contains no payload data. No base64 blobs, no binaries, no reconstructable script. Hashes, network indicators, and behavioural descriptions only — everything needed for detection and response, nothing usable for rebuilding the sample.
A 20 MB Windows batch file, presented as an installer for Specter Desktop (a Bitcoin multisig wallet coordinator), carries three base64-embedded payloads. It self-elevates via UAC, adds a Windows Defender exclusion for its own staging directory, and silently installs a ConnectWise ScreenConnect client pre-configured to call an attacker-controlled relay in unattended access mode. It then launches a legitimate, validly-signed DocuSign print driver as camouflage, wipes its staging directory, and removes the Defender exclusion.
The victim sees a plausible software installation complete successfully. They receive a real DocuSign product. They do not receive Specter Desktop. They do receive a persistent SYSTEM-level backdoor that is hidden from Add/Remove Programs and survives Safe Mode.
Three unrelated brands appear in one sample — filename says Specter, window title says "Feedback Tool", visible UI says DocuSign. This is a repurposed kit: the DocuSign lure is the original campaign, the filename was swapped for a crypto-focused target and nothing else was rebuilt.
This is access-broker tooling, not a self-contained stealer. There is no credential dumper, clipboard hijacker, or wallet grabber in the sample. The objective is durable hands-on-keyboard access; monetisation happens later over the ScreenConnect channel — historically wallet theft, business email compromise, or ransomware staging.
The Specter Desktop lure implies deliberate targeting of Bitcoin/cryptocurrency users. Any organisation in that sector receiving this should treat it as targeted rather than opportunistic.
| Field | Value |
|---|---|
| Filename | specter-installer-v2.3.4.bat |
| Size | 20,818,074 bytes |
| Type | ASCII text, CRLF, 5,280 lines |
| MD5 | 16c261f6246ae9e13f9e5d689b565947 |
| SHA-1 | 53f2fac736f732d7cfca16b59185bc12e060e82a |
| SHA-256 | 145e43f5b64f5c240a58b68da8eb1501c20198b81213751459dc335b5951072d |
Line 1 is a comment containing a 48-character random string. It serves as a campaign/build marker and, because it alters the file hash on every build, defeats naive hash-based blocklisting. Do not rely on the dropper hash alone for detection — see §7.
| Component | Size | SHA-256 | Verdict |
|---|---|---|---|
sc.msi |
9,965,568 | fae2254c77829098ce8f6510362eee42178498f1f639466d76954214eb08e40e |
Malicious — backdoor |
app.exe |
5,617,848 | 7ad243cd358d916e029ba8ff9a616dfdcab29b594a9ebf08a66a1c4bd63fb7e2 |
Benign — real signed DocuSign installer |
p.hta |
984 | 90ca96a19e8c7eeecf29e6a4c8408592fc91c28a1f5f48bd04f9585e1dd8af5d |
Malicious — social-engineering decoy |
Additional hashes:
MD5 fdbef61a4361eed8bb97e34ce658b6c3 sc.msi
MD5 026e2f3be5c707736be9b34250241a3b app.exe
MD5 bedb0094fcb5be5601001cd184c714ed p.hta
SHA-1 1d8a886c4da1bff7a40cc1ac8864ff9889627344 sc.msi
SHA-1 ea0a2144560d62376521be6c54b20c31f1a9dae6 app.exe
SHA-1 d397050485e92df805725a0bb4bb5c802cb83feb p.hta
| Step | Behaviour | Technique |
|---|---|---|
| 1 | Console UI initialised; window title set to "Feedback Tool" | T1036 Masquerading |
| 2 | Admin check; if not elevated, relaunches itself via cmd.exe with PowerShell Start-Process -Verb RunAs |
T1548.002 Bypass UAC |
| 3 | Creates staging directory C:\Windows\Temp\FT (destroys and recreates if present) |
T1074.001 Local staging |
| 4 | Adds a Defender exclusion path for the staging directory via Add-MpPreference |
T1562.001 Impair Defenses |
| 5 | Writes three base64 blobs to disk as .b64 files (~20 MB of echo lines) |
T1027 Obfuscated Files |
| 6 | Decodes all three to sc.msi, app.exe, p.hta using .NET Convert.FromBase64String via PowerShell |
T1140 Deobfuscate/Decode |
| 7 | Aborts with an error if the MSI failed to decode (integrity gate) | — |
| 8 | Launches the HTA decoy via mshta.exe |
T1218.005 Mshta |
| 9 | Installs the backdoor MSI silently (msiexec /quiet /norestart, wrapped in Start-Process -Wait) |
T1218.007 Msiexec |
| 10 | Waits 15s, then starts the implant service via both sc start and net start |
T1543.003 Windows Service |
| 11 | Launches the genuine DocuSign installer — no silent flag, full interactive wizard | T1036 Masquerading |
| 12 | After 3s, kills mshta.exe — decoy is dismissed exactly as the real wizard appears |
T1070 Indicator Removal |
| 13 | Prints "Complete", waits 10s, recursively deletes the staging directory | T1070.004 File Deletion |
| 14 | Removes the Defender exclusion it added in step 4 | T1070.009 Clear Persistence Artifacts |
Total runtime ≈ 35 seconds of visible console.
Elevation prompt is disguised. The script elevates cmd.exe rather than itself. The UAC dialog therefore reads "Windows Command Processor", publisher "Microsoft Windows", verified — rather than naming an unsigned batch file from the Downloads folder. This materially raises the odds a user clicks through.
The Defender exclusion is added and removed. The window is open only for the duration of the install. A host that scanned before or after the run would find nothing anomalous in its exclusion list; the artefact exists only in Windows Defender/Operational event logs (IDs 5007 / 5004). This is deliberate anti-forensics, and it is the single highest-fidelity detection opportunity in the whole chain — see §7.
Integrity gate before proceeding. The script verifies the MSI decoded before continuing, indicating the operator cared about reliable delivery rather than spray-and-pray.
An unsigned Windows Installer package containing a ConnectWise ScreenConnect client, version 25.3.4.9288, built by the attacker's own ScreenConnect server instance.
This is not a trojanised or modified ScreenConnect. It is stock, legitimate commercial remote-support software, weaponised entirely through its build-time configuration — the well-documented "RMM abuse" pattern. That is precisely what makes it dangerous: the binaries are ordinary, widely-deployed, and frequently allowlisted.
The malicious intent lives in the MSI's SERVICE_CLIENT_LAUNCH_PARAMETERS property:
e=Access → UNATTENDED access session type
y=Guest → session role
h=<attacker relay hostname>
p=8041 → relay port
k=BgIAAACkAABSU0ExAAgAAAEAAQD11p485g29… [TRUNCATED — attacker's RSA server public key]
e=Access is the critical field. ScreenConnect distinguishes Support sessions (attended — user must consent, session is visible) from Access sessions (unattended — permanent, silent, no consent prompt, no visible indicator). This client is built for the latter.
The MSI is not limited to screen sharing. It registers:
| Component | Consequence |
|---|---|
ScreenConnect.ClientService.exe |
Runs as a SYSTEM service; failure action set to restart |
ScreenConnect.WindowsFileManager.exe |
Silent bidirectional file transfer — exfiltration and tool ingress |
ScreenConnect.WindowsBackstageShell.exe |
Hidden command shell — operator gets a console without touching the visible desktop |
ScreenConnect.WindowsAuthenticationPackage.dll |
Registered under HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages — attacker-controlled DLL loaded inside LSA |
ScreenConnect.WindowsCredentialProvider.dll |
Registered as a Windows credential provider (CLSID {6FF59A85-BC37-4CD4-6A56-0E518F001062}) |
The Backstage shell and File Manager mean the operator has no need to move the mouse or blank the screen. There is nothing for a user to notice.
The LSA authentication package and credential provider are stock ScreenConnect features supporting login-as-user workflows. In an attacker's hands they place attacker-controlled code in the credential path of a SYSTEM-level authentication component. Treat any host running this as credential-compromised for every account used on it since install, including domain accounts, cached credentials, and anything typed at the logon screen.
- Service registered under
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\— survives Safe Mode with Networking - Service failure recovery set to
restart— kill the process, it comes back ARPSYSTEMCOMPONENT = 1— hidden from Add/Remove ProgramsARPNOMODIFY/ARPNOREPAIR— no user-facing management entry points- Custom URL protocol handler
sc-10e42781db8e46bfregistered - Ships its own
TerminateProcessescustom action for clean self-upgrade
A WiX Burn bootstrapper bundle: Docusign Print Driver 3.6.3 (xps x64).
This is authentic DocuSign software. It is not fake, not trojanised, and not modified.
That claim was verified rather than assumed. The Authenticode SHA-512 digest was recomputed over the PE image (excluding the checksum field and certificate table, per the Authenticode specification) and compared against the digest inside the embedded PKCS#7 SpcIndirectDataContent:
computed : F6808EC9DD34F08642F779DBE1BCD104EAC2A1D315067FE1DE6096B64BEACA06
156394C62172C48092F1922815B673CF48AE4970DB8ED02716B17DA08F37E977
in sig : F6808EC9DD34F08642F779DBE1BCD104EAC2A1D315067FE1DE6096B64BEACA06
156394C62172C48092F1922815B673CF48AE4970DB8ED02716B17DA08F37E977
✓ MATCH
| Field | Value |
|---|---|
| Signer | C=US, ST=California, L=San Francisco, O=DocuSign, Inc., OU=Engineering, CN=DocuSign, Inc. |
| Issuer | DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1 |
| Timestamp | Sectigo Public Time Stamping (RFC 3161) |
| Digest alg | SHA-512 |
| Compile time | 2019-09-17 |
Because the Authenticode digest covers the entire file except the certificate table, the match proves that both embedded WiX containers — the UX container and the ~3.9 MB attached payload container — are byte-for-byte as DocuSign shipped them. The bundle chain-installs .NET Framework 4.8 (if absent) and the DocuSign Print Driver MSI {A157A1EC-2BAF-4F16-ABBF-2C9BDA1967D9} v3.6.3.0.
- It survives scrutiny. The victim ends up with a working DocuSign driver and a legitimate, publisher-verified Add/Remove Programs entry. The installation "succeeded". Meanwhile the backdoor's own entry is suppressed.
- It is clean under AV and EDR. A validly-signed DocuSign binary executing raises nothing. Trojanising it would invalidate the signature and forfeit exactly the property the attacker wants.
Legitimate software as camouflage. The lie is not the product — it is the pretext that installing it was the point.
Do not treat
app.exe's hash as a malicious indicator. It is a clean, widely-distributed DocuSign binary and will appear on unrelated legitimate systems. Alerting on it will generate false positives. It is listed here only for chain-of-custody completeness.
984 bytes of static HTML executed through mshta.exe. Contains no script logic beyond window.resizeTo / window.moveTo centring — no downloader, no dropper, no obfuscation. Its entire function is to occupy the screen for ~20 seconds while the backdoor MSI installs silently behind it.
Presents: a DocuSign logo (hotlinked from a third-party public stock-logo site, not from DocuSign infrastructure), the text "Installing, please wait…", and a CSS-animated progress bar with a 40-second @keyframes transition from 5% to 95%. The progress bar is pure animation and reflects no actual installation state.
The hotlinked logo is a useful network indicator: an outbound request to a stock-logo CDN for a DocuSign asset, from a host that is not browsing, at the same moment as an msiexec execution.
- Console window titled "Feedback Tool", ASCII banner, "Requesting administrator privileges…"
- UAC prompt reading "Windows Command Processor", Microsoft-verified
- Second console: "Preparing files…", "Decoding files…"
- Small centred DocuSign popup with animated progress bar (~20 s)
- Popup vanishes; real DocuSign Print Driver wizard opens
- Console prints "Complete", closes after 10 s
No Specter Desktop is installed at any point. A user who later looks for it will find nothing — and, because the implant is hidden from Add/Remove Programs, will reasonably conclude the installer simply failed.
Defender exclusion added and then removed within minutes, for a path under C:\Windows\Temp.
Windows Defender Operational log — Event ID 5007 (configuration changed). Legitimate software effectively never does this. A transient add/remove pair on the same path is close to conclusive on its own.
powershell.exeinvokingAdd-MpPreference -ExclusionPath— alert on this unconditionally, low volume in most estatesmsiexec /quiet /norestartinstalling fromC:\Windows\Temp\*mshta.exeexecuting an.htafromC:\Windows\Tempcmd.exespawned bypowershell.exewith-Verb RunAsand a.batpath argument- PowerShell
[IO.File]::WriteAllBytes+FromBase64Stringin the same command line - Service creation matching
ScreenConnect Client (*) - New registry value under
Control\Lsa\Authentication Packages— always worth an alert - New CLSID under
...\Authentication\Credential Providers\ - Any service registered under
Control\SafeBoot\Network\ - Outbound TCP to port 8041
- Any ScreenConnect client whose relay host is not your organisation's approved instance
Run this regardless of whether this specific sample is believed to have executed — ScreenConnect abuse is widespread and the same relay may have been delivered by other means:
Registry: HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (*)
Files: C:\Program Files (x86)\ScreenConnect Client (*)\
Config: inspect ImagePath / app.config for the h= relay parameter
Network: any egress to the relay domain below, or to :8041
Enumerate every ScreenConnect installation in the estate and validate each relay host against your approved instance. If your organisation does not use ScreenConnect at all, any presence is malicious by definition.
Network indicators are defanged. Do not resolve, browse, or connect from a production host.
| Indicator | Detail |
|---|---|
zonastoski[.]com |
ScreenConnect relay (C2) |
zonastoski[.]com:8041 |
Relay port |
| TCP/8041 | Non-standard ScreenConnect relay port |
Service name ScreenConnect Client (10e42781db8e46bf)
URL scheme sc-10e42781db8e46bf
ProductCode {14EDE591-C18D-3373-10E4-2781DB8E46BF}
CredProv CLSID {6FF59A85-BC37-4CD4-6A56-0E518F001062}
Client version 25.3.4.9288
HKLM\SYSTEM\CurrentControlSet\Services\ScreenConnect Client (10e42781db8e46bf)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ScreenConnect Client (10e42781db8e46bf)
HKLM\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (modified)
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers\{6FF59A85-BC37-4CD4-6A56-0E518F001062}
HKCR\sc-10e42781db8e46bf
C:\Windows\Temp\FT\ staging directory (deleted after run)
C:\Windows\Temp\FT\m.b64 MSI, base64
C:\Windows\Temp\FT\e.b64 decoy, base64
C:\Windows\Temp\FT\h.b64 HTA, base64
C:\Windows\Temp\FT\sc.msi backdoor installer
C:\Windows\Temp\FT\app.exe benign DocuSign decoy
C:\Windows\Temp\FT\p.hta fake progress dialog
C:\Program Files (x86)\ScreenConnect Client (10e42781db8e46bf)\ persistent install
Note: because the staging directory is deleted, absence of these files does not indicate absence of compromise. The Program Files (x86) path and the service are the durable artefacts.
Defender/Operational 5007 exclusion path added, then removed ← strongest signal
Defender/Operational 5004 real-time protection config changed
System 7045 service installed: ScreenConnect Client (…)
Security 4697 service installed (if audited)
Application 1033/1042 MsiInstaller — ScreenConnect product install
Remote-control access at SYSTEM level, with attacker code registered in LSA and as a credential provider, is not a cleanable condition.
- Isolate the host immediately. Network-contain before investigating; the operator has an interactive channel and may react to being discovered.
- Preserve evidence before remediation — memory image, Defender Operational log, System log,
C:\Program Files (x86)\ScreenConnect Client (*)\includingapp.config, and MSI installer logs. - Rebuild from known-good media. Do not attempt cleanup. Uninstalling the ScreenConnect client removes the RMM tool; it does not establish what was done during the access window, what was installed alongside it, or what was taken.
- Rotate every credential used on or reachable from that host — local accounts, domain accounts, cached credentials, browser-stored passwords, SSH keys, API tokens, cloud credentials, MFA seeds and session cookies. The LSA-resident component makes this non-optional.
- In a cryptocurrency context, treat all wallet material on or accessible from the host as compromised. Any hot wallet key, seed phrase, PSBT workflow, exchange API key, or hardware-wallet-adjacent software configuration. Move funds using a clean device. Assume watch-only descriptors and xpubs were exfiltrated — these enable long-term surveillance and targeted social engineering even without spending capability.
- Review the full access window — from service install timestamp to containment. Check lateral movement, new accounts, scheduled tasks, mailbox rules, and OAuth grants.
- Block the relay domain and audit historical DNS and proxy logs for it.
- Enumerate and validate every ScreenConnect installation (§7).
- Alert on
Add-MpPreferenceusage. - Consider blocking
.bat,.hta,.cmdand.scrat the mail and web gateway, and enabling Defender ASR rules formshtaand script-launched executables.
Submit the dropper hash to your AV vendors and report the relay domain to its registrar and hosting provider. If the Specter Desktop lure indicates targeting of your sector, share the IOCs with the relevant sector CERT or industry sharing group.
Performed entirely statically on macOS. The sample is a Windows batch file and was never executed; no sandbox detonation was required or performed.
- Structural triage of the batch file — line-length distribution isolated three contiguous blocks of base64
echolines from ~40 lines of actual logic. - Payload reconstruction by extracting only
echo-prefixed lines within each block, replicating the script's own concatenation order while excluding batch redirection syntax. (Naïve character-class stripping corrupts the output: the redirect targets contain valid base64 characters that would be spliced into the stream.) - File-type identification and hashing of the three decoded artefacts.
- MSI analysis via OLE compound-document string extraction — recovered product metadata, the component and registry tables, service configuration, and the embedded launch parameters.
- PE analysis of the decoy — section table and entropy,
.wixburnsection identifying it as a WiX Burn bundle, and location of the two embedded cabinet containers. - WiX Burn manifest extraction from the UX container, confirming bundle identity and chain composition.
- Authenticode verification — certificate chain extracted from the security directory; ASN.1 parse of the PKCS#7 to recover the declared digest algorithm (SHA-512) and
SpcIndirectDataContentdigest; independent recomputation of the Authenticode hash over the PE with checksum and certificate table excluded; byte comparison. Match confirmed.
- No dynamic analysis. Actual network behaviour, operator tasking, and post-access activity are inferred from configuration, not observed.
- The MSZIP-compressed attached cabinet inside
app.exewas not decompressed — no suitable extractor was available on the analysis host. This does not affect the conclusion: the verified Authenticode digest covers those bytes, proving them unmodified from DocuSign's build. - The ScreenConnect relay was not contacted. Infrastructure attribution, hosting details, and campaign scope are out of scope for this report.
- No attribution to a named threat actor is offered. The tradecraft — fake installer, RMM abuse, signed-software camouflage, transient Defender exclusion — is common to multiple access-broker and ransomware-affiliate crews and is not distinctive enough to attribute on this evidence alone.
| Tactic | Technique |
|---|---|
| Initial Access | T1189 Drive-by Compromise · T1204.002 User Execution: Malicious File |
| Execution | T1059.001 PowerShell · T1059.003 Windows Command Shell · T1218.005 Mshta · T1218.007 Msiexec |
| Persistence | T1543.003 Windows Service · T1547.002 Authentication Package · T1547.999 Credential Provider |
| Privilege Escalation | T1548.002 Bypass User Account Control |
| Defense Evasion | T1562.001 Impair Defenses: Disable or Modify Tools · T1027 Obfuscated Files or Information · T1140 Deobfuscate/Decode Files · T1036.005 Masquerading: Match Legitimate Name · T1070.004 File Deletion · T1070.009 Clear Persistence Artifacts · T1553.002 Subvert Trust Controls: Code Signing |
| Credential Access | T1556.002 Modify Authentication Process |
| Command and Control | T1219 Remote Access Software · T1571 Non-Standard Port |
Static analysis report. Sample not executed. Contains no payload data — hashes and behavioural indicators only.