ToolboxRelayUploader.exe

Reported Context (2)

The decoder also stages ToolboxRelayUploader.exe for console-based payload distribution and retrieves sqlite3.exe for browser-cookie queries if a suitable copy is absent. Microsoft Details SCKit Malware Abuse of ScreenConnect to Target MSP Technicians
Next, ToolboxRelayUploader.exe is engineered to use access gained to any other sessions to upload a payload, WithUninstall.ps1, to the panel's Shared Toolbox. A panel request tells every reachable session to run the Huntress Links SCKit ScreenConnect Worm Activity to Flawed RMM+ Extension

CVE (1)

Malware (2)

People (8)

MITRE ATT&CK (15)

Vendors (3)

Products (5)

Tools (1)

Industries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.