Malware
EvilConwi
EvilConwi is a malicious variant of the legitimate ScreenConnect software by ConnectWise.
EvilConwi is a Windows malware family.
Background
EvilConwi is a weaponized version of ConnectWise's legitimate ScreenConnect remote-access tool. Attackers heavily alter its configuration to strip out any indication that a remote session is active, and EvilConwi frequently disguises its activity as a Windows update by embedding bogus Windows update images in the config, keeping the machine occupied while the operator connects remotely.
Another hallmark of EvilConwi is the use of fake application icons; for instance, it may impersonate a Zoom installer by adopting Zoom's icons and application titles within the ConnectWise config.
Source: Malpedia (Fraunhofer FKIE).