🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3b65185390624b4222b0ef816bc01b735096429ca8da8e2a040c5a61e6b44752. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 7


Intelligence 7 IOCs YARA 1 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 3b65185390624b4222b0ef816bc01b735096429ca8da8e2a040c5a61e6b44752
SHA3-384 hash: e3f01c6b5a7079ff544cf7c2d4b638fce58e263c10dfc53f1005f073bf339f6569d687ac122db3067fb828069ffffc10
SHA1 hash: 8b66b23468ebc384b993969ae44317e687a5b2a9
MD5 hash: 7b25c90ffe2c2bfb7d6d52ab44b3191c
humanhash: video-enemy-solar-lactose
File name:hongyang2015.com.ps1
Download: download sample
File size:20'092 bytes
First seen:2026-07-19 07:13:28 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/html
ssdeep 384:X4FTAsXe7FUFh/+4MA6ksb7RYsa7bWkkg1k4iPiliri/iIk4i7aiyKi8iJiyILnL:Xe8sXe7FUFk3usafWkkg1kVKUO6IkV7J
TLSH T12D92B71669B300226913C0BC6BE79746333180079645CE6A3FAC5294DF8AEE5ADF37DC
Magika html
Reporter JAMESWT_WT
Tags:85-239-149-178 booking deyetechnical-com hongyang2015-com ps1 Spam-ITA v0hkpadr04mbz5lkearqa-com

Intelligence

File Origin
# of uploads :
1
# of downloads :
104
Origin country :
IT IT
Vendor Threat Intelligence
No detections
Detection(s):
SecuriteInfo.com.HTML.FakeCaptcha-BO.98125546.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Script.SNH-gen.64277769.UNOFFICIAL
Create hunting rule

Verdict:
Malicious
Score:
91.7%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5c795d85479d70bfb76ff9
Tags:
malware
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
aidetect masquerade phishing
Link:
https://www.filescan.io/uploads/6a5c79576ea545889d02e100/reports/5081be30-c8d1-4bcb-a338-b6ea0b170261/overview
Verdict:
Malicious
Labled as:
HTML/FakeCaptcha.BV trojan
Link:
https://www.hybrid-analysis.com/sample/3b65185390624b4222b0ef816bc01b735096429ca8da8e2a040c5a61e6b44752
Verdict:
Malicious
File Type:
html
First seen:
2026-05-10T11:28:00Z UTC
Last seen:
2026-07-21T01:23:00Z UTC
Hits:
~100
Link:
https://opentip.kaspersky.com/3b65185390624b4222b0ef816bc01b735096429ca8da8e2a040c5a61e6b44752/results?tab=lookup
Score:
2%
Verdict:
Benign
File Type:
SCRIPT
Link:
https://malprob.io/report/3b65185390624b4222b0ef816bc01b735096429ca8da8e2a040c5a61e6b44752
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Html SVG
Link:
https://app.malva.re/file/7b25c90ffe2c2bfb7d6d52ab44b3191c
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/3b65185390624b4222b0ef816bc01b735096429ca8da8e2a040c5a61e6b44752/
Threat name:
Document-HTML.Trojan.FakeCaptcha
Create hunting rule
Status:
Malicious
First seen:
2026-05-12 17:15:10 UTC
File Type:
Text (HTML)
Extracted files:
4
AV detection:
12 of 24 (50.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=hnsrqu4qmjfueivq56awxqa3onijmqu4vdni4kqebrngdzvui5ja._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
discovery
Link:
https://tria.ge/reports/260719-h2xtnaev5q/
Behaviour
Checks processor information in registry
Enumerates system info in registry
Modifies data under HKEY_USERS
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
Suspicious use of FindShellTrayWindow
Suspicious use of SendNotifyMessage
Suspicious use of WriteProcessMemory
Browser Information Discovery
System Time Discovery
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.10
Link:
https://yomi.yoroi.company/submissions/3b65185390624b4222b0ef816bc01b735096429ca8da8e2a040c5a61e6b44752

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:telebot_framework
Create hunting rule
Author:vietdx.mb

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments