MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3cb35987211d9d3cb9ca2e159aed920cf19d8bc5e0695ef9837abe0454312ee4. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	3cb35987211d9d3cb9ca2e159aed920cf19d8bc5e0695ef9837abe0454312ee4
SHA3-384 hash:	3790297589ef08f586f1abfe872ad6cbd7481ab76320fc3f21da235376f1ac2f264cba456e51a1be3a8763e1b8e1b3aa
SHA1 hash:	b038b98cafc9e40e1312509db8fdc7cfa83a1f4f
MD5 hash:	cfda7f1240ac98dafed7d29196727dbe
humanhash:	social-october-aspen-vermont
File name:	greatnamechangedwithgoodnews.hta
Download:	download sample
Signature	Formbook Alert Create hunting rule
File size:	16'033 bytes
First seen:	2025-02-07 05:36:04 UTC
Last seen:	Never
File type:	hta
MIME type:	text/html
ssdeep	48:3viiLLhL8GLLlwlL8KGE0n+Pepeb299DdZdIMcXDPzLLD+LLgpJV/L8ADLLrOPG:fiihIGkIK307Ab2fPd1cXfC4IqK+
TLSH	T1DF7270061D95DD8E1F84297065CC4AC0473E9B3E488A2702714FDE6A47C26B4ECCEE93
Magika	txt
Reporter	abuse_ch
Tags:	FormBook hta

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

82

Origin country :

DE

Vendor Threat Intelligence

ClamAV Detected

Detection(s):

SecuriteInfo.com.Script.SNH-gen.13238.10779.UNOFFICIAL

Alert

Create hunting rule

CyberFortress Malicious

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=67a59c92dbfc8aaee8cd5f97

Tags:

obfuscate shell sage

DocGuard Malicious

Result

Verdict:

Malicious

File Type:

HTA File - Malicious

Link:

https://app.docguard.net/3cb35987211d9d3cb9ca2e159aed920cf19d8bc5e0695ef9837abe0454312ee4/results/dashboard

Payload URLs

URL

File name

http://198.12.81.151/680/csee.exe

HTA File

Behaviour

BlacklistAPI detected

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Tags:

powershell

Link:

https://www.filescan.io/uploads/67a59bd61ee194700efda807/reports/daba4245-d314-45fe-a5b8-3df42550f57b/overview

Hybrid Analysis VBS.Asthma.2.BD73F937

Verdict:

Malicious

Labled as:

VBS.Asthma.2.BD73F937

Link:

https://www.hybrid-analysis.com/sample/3cb35987211d9d3cb9ca2e159aed920cf19d8bc5e0695ef9837abe0454312ee4

InQuest MALICIOUS

Result

Verdict:

MALICIOUS

Details

Base64 Encoded URL

Detected an ANSI or UNICODE http:// or https:// base64 encoded URL prefix.

Joe Sandbox Cobalt Strike, FormBook

Result

Threat name:

Cobalt Strike, FormBook

Alert

Create hunting rule

Detection:

malicious

Classification:

troj.spyw.expl.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1608982

Signature

.NET source code contains potential unpacker

Antivirus detection for URL or domain

Detected Cobalt Strike Beacon

Found direct / indirect Syscall (likely to bypass EDR)

Injects a PE file into a foreign processes

Joe Sandbox ML detected suspicious sample

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Performs DNS queries to domains with low reputation

PowerShell case anomaly found

Powershell drops PE file

Sigma detected: Dot net compiler compiles file from suspicious location

Sigma detected: Suspicious MSHTA Child Process

Suricata IDS alerts for network traffic

Suspicious command line found

Suspicious powershell command line found

Switches to a custom stack to bypass stack traces

Tries to harvest and steal browser information (history, passwords, etc)

Tries to steal Mail credentials (via file / registry access)

Yara detected AntiVM3

Yara detected FormBook

Yara detected Powershell decode and execute

Behaviour

Behavior Graph:

Download SVG

Nucleon Malprob Malware

Score:

100%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/3cb35987211d9d3cb9ca2e159aed920cf19d8bc5e0695ef9837abe0454312ee4

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3cb35987211d9d3cb9ca2e159aed920cf19d8bc5e0695ef9837abe0454312ee4/

ReversingLabs TitaniumCloud Script-WScript.Trojan.Remcos

Threat name:

Script-WScript.Trojan.Remcos

Alert

Create hunting rule

Status:

Malicious

First seen:

2025-02-06 16:10:04 UTC

File Type:

Text (HTML)

Extracted files:

1

AV detection:

11 of 38 (28.95%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=hszvtbzbdwotzookfykzv3msbtyz3c6f4buv56mdpk7aivbrf3sa._file

Hatching Triage Malicious

Result

Malware family:

n/a

Score:

  8/10

Tags:

defense_evasion discovery execution

Link:

https://tria.ge/reports/250207-gap43a1jc1/

Behaviour

Modifies Internet Explorer settings

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of SetThreadContext

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Blocklisted process makes network request

Downloads MZ/PE file

Evasion via Device Credential Deployment

VMRay Malicious

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/3cb35987211d/report/overview.html

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/3cb35987211d9d3cb9ca2e159aed920cf19d8bc5e0695ef9837abe0454312ee4