Fake SCPToolkit uploaded to MB by aachum:

Signed EXE "jmutanen software Oy" loads an MSI and the real SCPToolkit as a decoy. Installs ScreenConnect: microsoftnet[.]ru

Files from signer: https://bazaar.abuse.ch/browse/tag/jmutanen%20software%20Oy/

Zip with parts:
https://www.virustotal.com/gui/file/1dff513d05c2d51b18ad7f4fda789347760fc84e02cb88edb5d974f32589cf40/details

Triage: https://tria.ge/250401-nj9cmazqs2/behavioral1