MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 0a0b2e73ea9c9d12bb221f7ef9518c11e29dd1a0a28100a51ea51762ba35b20d. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

KongTuke

Vendor detections: 6

Intelligence 6 IOCs YARA 14 File information Comments

SHA256 hash:	0a0b2e73ea9c9d12bb221f7ef9518c11e29dd1a0a28100a51ea51762ba35b20d
SHA3-384 hash:	1d121d78b864e16739b423b343fcce25d4363faf795da745b74eff76b32d976725670aa5ce373a3a83d4bdcdff863501
SHA1 hash:	8baf1a60b11ca0f1aa46d887cfc88e353319907e
MD5 hash:	037bd459c8b8b9e3815b32a145c84a7c
humanhash:	orange-sodium-mexico-zebra
File name:	package
Download:	download sample
Signature	KongTuke Create hunting rule
File size:	6'961'104 bytes
First seen:	2026-06-29 13:09:20 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:MgrSSDlI196toOSfy+S9Y+UxW2VVpNFjmqFZb0:MoSSDWT6OOGy/9SH1FyMb0
TLSH	T1756633E53C24284BD1D9327566D404B39320BC4E4AD47E62BC7B7B6D6532BC68A6B3C3
Magika	zip
Reporter	monitorsg
Tags:	Kongtuke zip

monitorsg

hXXps://bogisibh[.]xyz/file.js (ClickFucker) --> hXXps://bogisibh[.]xyz/api/v1/session (token) --> hXXps://bogisibh[.]xyz/api/v1/verify (gateway) --> hXXps://bogisibh[.]xyz/api/v1/status (clipboard) --> hXXps://synccert7665[.]com/update/package (tar)

Intelligence

File Origin

# of uploads :

# of downloads :

170

Origin country :

File Archive Information

This file archive contains 23 file(s), sorted by their relevance:

File name:	xul.dll
File size:	5'662'208 bytes
SHA256 hash:	2f342120d9d68248e6bc17fd9953e3af8e5a7858f4a18e802c858cc9c74a1b58
MD5 hash:	ba5e22e1fea3d6378bf207eb5717eefc
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozglue.manifest
File size:	240 bytes
SHA256 hash:	23680bbba9edbbfab98e27f9bd676b031da3b20adfe909ce86c9ecc1b8bb80d1
MD5 hash:	5d5e62ad6d1023592406fe3ea1f0ea75
MIME type:	text/xml
Signature	KongTuke

File name:	vcruntime140_1.dll
File size:	47'264 bytes
SHA256 hash:	e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 hash:	03b43160d21c08de07a79d0a1c5ee81d
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	AccessibleMarshal.dll
File size:	233'984 bytes
SHA256 hash:	550b95abf2436c66bcddabd164562bccf9798c7afc5b78c0602c690e762bc95a
MD5 hash:	974bcb1a35cb685daea91e7bdefc354d
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	gkcodecs.dll
File size:	233'472 bytes
SHA256 hash:	e729243fbc8d6ab60e00925651da1b0624677dd1630ee83a140d3e41144f6227
MD5 hash:	d95a89668d498fb5ec8cc4be7004ed90
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozglue.dll
File size:	606'720 bytes
SHA256 hash:	1b30f8365647b9d05c82f40d1becdc21f7348b17bc7dd1921d7db7351cf5113c
MD5 hash:	7ef67726b0eb84b7bf67e11e834ceec0
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	plugin-container.exe
File size:	144'512 bytes
SHA256 hash:	653a27b36c41fbb6ac9e7538b481e95b77ebc7eb4f83eb99b4838c81bff64dfa
MD5 hash:	6935302137f3152317eb6a3b4a74f8c5
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	wmfclearkey.dll
File size:	259'072 bytes
SHA256 hash:	63c546cf0f1c2051c734ec9ed09bbdf4278d55c4c0215f34da903a18701d8ecf
MD5 hash:	208e5786d7c6ccae718b2725c50a3f02
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	freebl3.dll
File size:	233'472 bytes
SHA256 hash:	ff2fea9f328437f6a91e0cd4c519fb56c0ca65777231154129ce7b547bff1c53
MD5 hash:	807f56fb8abd64980d3c17490864f796
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozinference.dll
File size:	250'368 bytes
SHA256 hash:	2ee3c7590c20287daa8ae70b20baf4e563f914c9de2677185b02097ca5d71d15
MD5 hash:	d5b1d27bbb083679f791c75a64dec98e
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	vcruntime140.dll
File size:	123'472 bytes
SHA256 hash:	184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 hash:	0d35c5e99871b4f02c490b9fd9dace34
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	nss3.dll
File size:	238'592 bytes
SHA256 hash:	c5603db3d09828523a508e7a40c52be95f7084543e392161ef7203e0ec85edfa
MD5 hash:	f0d2858c53c72e3c8255fcb0c9aedacb
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	libEGL.dll
File size:	1'496'576 bytes
SHA256 hash:	4cdb91d0a92775a43ca2dd4b92481b849532359649e40d16e307eb59414cc4b4
MD5 hash:	91a62ae46b52527eccb497f434f065c3
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	libGLESv2.dll
File size:	1'672'704 bytes
SHA256 hash:	361c1a20cc26c330959fc8cdd5a48b45a4543e06857ff60b5f12502fa09abf40
MD5 hash:	6604ad4104277c77876667555b2fbe3b
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	notificationserver.dll
File size:	233'984 bytes
SHA256 hash:	b447368a74f969bd9edafd9be488e0abb70175b337c536989ea84d74df2bac5e
MD5 hash:	9231ab16d73a1bfe504cabc3c54f1be6
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozavcodec.dll
File size:	294'400 bytes
SHA256 hash:	de2fe27bc72f73c5392439495a67dd63857a09220f51fe5079398fb1a9651d66
MD5 hash:	3652afbb10a32b9c492c62b00f6b1457
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozavutil.dll
File size:	237'056 bytes
SHA256 hash:	f239e33de04004d6215c020f0d66a9e49b443bb60d66ff3ed8c109955a6b16fc
MD5 hash:	10903eef7df1f4adc9e28dc2d8c21f7a
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	2
File size:	342 bytes
SHA256 hash:	d3ba6d7356137377ef02fc0ef15e97b7b4619e18206b83047d758cd1551479ec
MD5 hash:	e329183d61421d9516c6db70aa146c22
MIME type:	text/xml
Signature	KongTuke

File name:	msvcp140.dll
File size:	553'552 bytes
SHA256 hash:	def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 hash:	4e3fa9bd90ef020c14359639dc19312b
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	firefoxupdate.dll
File size:	234'496 bytes
SHA256 hash:	6e58929ff4c95c819e20b3ab4b179cbda4f556fe12b3003b9ac6961e516c4a7a
MD5 hash:	bbfbcd09e7c16294f9749942fc96fcbd
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozwer.dll
File size:	234'496 bytes
SHA256 hash:	80d2f9aaa752d4aaea60ea6bd9428766d6871c41e92987b5fb9e16bdc65307cd
MD5 hash:	14795ac73fba6f93a0485c44ce1c088c
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	lgpllibs.dll
File size:	240'128 bytes
SHA256 hash:	afcaabb50ca6f70a696c68efd2a1e7d110f0b02372960e985eeb1b16b1ce2af1
MD5 hash:	83ee266a472364020ca6910006a225c3
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	softokn3.dll
File size:	243'712 bytes
SHA256 hash:	338ce7ad483a73f6a08cf6ae3dfbc9b953d545fab65a60d0ebcf5bdbfcfcfce8
MD5 hash:	d025a2d0ad842dbce17112c296a4660a
MIME type:	application/x-dosexec
Signature	KongTuke

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/7cc1e9ff-b117-4bc3-b246-5b9155015358/

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=69d6459a6a61012f6ad0109b

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/0a0b2e73ea9c9d12bb221f7ef9518c11e29dd1a0a28100a51ea51762ba35b20d

Verdict:

Clean

File Type:

zip

Link:

https://opentip.kaspersky.com/0a0b2e73ea9c9d12bb221f7ef9518c11e29dd1a0a28100a51ea51762ba35b20d/results?tab=lookup

Score:

48%

Verdict:

Susipicious

File Type:

Result

Malware family:

n/a

Score:

8/10

Tags:

adware persistence spyware

Link:

https://tria.ge/reports/260629-qyspjagv2q/

Behaviour

Checks SCSI registry key(s)

Modifies Internet Explorer settings

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/0a0b2e73ea9c9d12bb221f7ef9518c11e29dd1a0a28100a51ea51762ba35b20d

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KongTuke

zip 0a0b2e73ea9c9d12bb221f7ef9518c11e29dd1a0a28100a51ea51762ba35b20d

(this sample)

Link

https://infosec.exchange/@monitorsg/116833554053336427

Delivery method

Distributed via web download

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample