VBScript remediation
Audit mode is the default; the explicit /apply argument enables evidence-bound cleanup and quarantine.
Published September 5, 2026 · Last reviewed September 8, 2026
Defensive tools for a specific ScreenConnect remote-access malware campaign.
For IT providers and incident responders. If you own the business, send this page to whoever manages your computers.
This free Windows remediation targets the SPECIAL PARTY INVITATION chain associated with ScreenConnect instance fa12121053c2d7fe and relay relay.rupilure.top at 74.120.121.48:8041. The indicators come from KernelHawk's own incident work. It audits alternative connection and persistence paths, removes confirmed changes, and preserves evidence for review.
Community preview
Download the complete two-script remediation.
Keep the VBScript and PowerShell audit engine in the same folder. Review the source and checksum before running it. The audit has been run end to end on a clean Windows 11 host; the /apply path is fail-closed by design but has not yet been exercised against a live infection, so try it on a disposable or backed-up system first. No audit output is sent to KernelHawk or anywhere else, and the campaign relay is never resolved or contacted, so cleaning a host does not announce itself to the attacker. That is not the same as no network traffic: signature validation may retrieve certificate revocation data, and /apply starts Microsoft Defender, whose cloud protection may communicate with Microsoft. Both use services this computer is already configured to use. Test it in an isolated Windows system before organization-wide deployment.
PowerShell audit engine
Collects current and historical connection evidence, persistence, accounts, remote-access state; signatures, hashes, and relevant Windows events.
Instructions and integrity
Read the operating notes and compare every downloaded file with the published SHA-256 values. The software is licensed under the MIT License by the KernelHawk operator.
Audit before and after
Records processes and connections; listeners, DNS, and services; tasks, autoruns, and WMI; RDP, WinRM, OpenSSH, and BITS; firewall and account state; Defender settings, recent executables, and relevant event logs.
Quarantine instead of permanent deletion
Confirmed payloads and target folders move beneath %ProgramData%\KernelHawk-ScreenConnect-Remediation. Before removal, the tool exports registry keys and scheduled tasks, then captures autorun values and WMI subscriptions. Firewall rules and Defender exclusions are included.
Protect approved business tools
Unknown remote-access software and suspicious persistence are ranked for human review. Automatic removal requires the exact incident identifiers or known hashes, so an approved deployment of the same product is reported rather than removed.
Finish recovery outside the script
Isolate the affected host, preserve needed evidence, rotate credentials from a clean device, review identity and client-data access, run an offline scan, and rebuild when system integrity cannot be established.
Start with the read-only audit
Start with the non-changing audit.
- Place both scripts in one folder.
- Run
cscript //nologo remediate_party_invitation_rat.vbs. - Review the audit beneath
%ProgramData%\KernelHawk-ScreenConnect-Remediation\Audits. - When the indicators match, run
cscript //nologo remediate_party_invitation_rat.vbs /apply. - Reboot, run Microsoft Defender Offline, rotate credentials, and review account activity.