MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KongTuke


Vendor detections: 6


Intelligence 6 IOCs YARA 16 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93
SHA3-384 hash: dd6d7d5b68b496e51e07bee3cb95d86a77a6764922b6bc32475e1eb863ad498ac92d10eea3183d72f3667fa799a9a705
SHA1 hash: de74f2d081b6621d9210e012eed799d3b7de70b8
MD5 hash: 094adf26800a7583981600ec680f7eca
humanhash: vermont-jupiter-lake-grey
File name:package
Download: download sample
Signature KongTuke
Create hunting rule
File size:7'000'234 bytes
First seen:2026-06-30 15:09:41 UTC
Last seen:Never
File type: zip
MIME type:application/zip
ssdeep 196608:desYTnk8I4JrWAKDGqGfOL5nVrxUxzFh+dIw3UaWO2Y9yD:56kUBWAKDufOL5nVmJh+NUaX19I
TLSH T1CC66331E480E766BCCDC53FA14C31ADAF5225D0E0F85A1AB5483F4BD9041C9AFB2976E
TrID 60.0% (.USDZ) Universal Scene Description Zipped AR format (generic) (6000/1/1)
40.0% (.ZIP) ZIP compressed archive (4000/1)
Magika zip
Reporter monitorsg
Tags:Kongtuke zip


Avatar
monitorsg
hXXps://ackeamann[.]xyz/file.js (ClickFucker) --> hXXps://ackeamann[.]xyz/api/v1/session (token) --> hXXps://ackeamann[.]xyz/api/v1/verify (gateway) --> hXXps://ackeamann[.]xyz/api/v1/status (clipboard) --> hXXps://appupdate3049[.]top/update/package (tar)

Intelligence

File Origin
# of uploads :
1
# of downloads :
206
Origin country :
US US
File Archive Information

This file archive contains 23 file(s), sorted by their relevance:

File name:xul.dll
File size:5'739'008 bytes
SHA256 hash: a77e8d66cdd86e61cbea6772998e764be6078ec76c4c0b95f79a635815b18343
MD5 hash: 73a70c0c128ef679425537e6286b8073
MIME type:application/x-dosexec
Signature KongTuke
File name:mozglue.manifest
File size:240 bytes
SHA256 hash: 23680bbba9edbbfab98e27f9bd676b031da3b20adfe909ce86c9ecc1b8bb80d1
MD5 hash: 5d5e62ad6d1023592406fe3ea1f0ea75
MIME type:text/xml
Signature KongTuke
File name:vcruntime140_1.dll
File size:47'264 bytes
SHA256 hash: e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 hash: 03b43160d21c08de07a79d0a1c5ee81d
MIME type:application/x-dosexec
Signature KongTuke
File name:AccessibleMarshal.dll
File size:233'984 bytes
SHA256 hash: aee6f4eb3bf1d8c3de98be3a6450e3026ea587c77f7d148e33494aec55c9890f
MD5 hash: db1814ec7071e68547b5b3d441866161
MIME type:application/x-dosexec
Signature KongTuke
File name:gkcodecs.dll
File size:233'472 bytes
SHA256 hash: a63fd25c2de18e88743fb1cd15ff91ce858c165c7cd2f82fff4a5f50037f986e
MD5 hash: 6830e66448563155561218802e309b1b
MIME type:application/x-dosexec
Signature KongTuke
File name:mozglue.dll
File size:610'816 bytes
SHA256 hash: 762351828e4411d636a2836655f89878306bee3d0222910017b30339d69d30bf
MD5 hash: b8ed925d37e0cfab96ff425b52a30e09
MIME type:application/x-dosexec
Signature KongTuke
File name:plugin-container.exe
File size:144'512 bytes
SHA256 hash: 653a27b36c41fbb6ac9e7538b481e95b77ebc7eb4f83eb99b4838c81bff64dfa
MD5 hash: 6935302137f3152317eb6a3b4a74f8c5
MIME type:application/x-dosexec
Signature KongTuke
File name:wmfclearkey.dll
File size:259'072 bytes
SHA256 hash: aea3d436c08934635fbbb9f4d4b9153d8bbab19749651f802fa9eb9fe031b7af
MD5 hash: 0293f9110c412825a37c98b330f241b7
MIME type:application/x-dosexec
Signature KongTuke
File name:freebl3.dll
File size:233'472 bytes
SHA256 hash: 77f404ae987991435de259df8ce79f89752e67cdbffcc72bbacc612523b712c1
MD5 hash: b5cc487f78cb79281c6c0c96f9514845
MIME type:application/x-dosexec
Signature KongTuke
File name:mozinference.dll
File size:250'368 bytes
SHA256 hash: 48e1f3d9ec647241ec1cea207a466deee77de744f40d7a5f1dc0b533eae734ff
MD5 hash: 61464b0d050547a62e183b626c110675
MIME type:application/x-dosexec
Signature KongTuke
File name:vcruntime140.dll
File size:123'472 bytes
SHA256 hash: 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 hash: 0d35c5e99871b4f02c490b9fd9dace34
MIME type:application/x-dosexec
Signature KongTuke
File name:nss3.dll
File size:238'592 bytes
SHA256 hash: 78d34d0ac6d2171ade4828a91e1e60c5ca785ff217eb12804982d0aeefa3db6a
MD5 hash: 11fd862f3994b2b22cd1f9bbcfd5c01a
MIME type:application/x-dosexec
Signature KongTuke
File name:libEGL.dll
File size:1'495'552 bytes
SHA256 hash: c26bc0cb64669f2518bf8df3f3c48b902b1a64eb24dd5e19afb69fcd2d1337b0
MD5 hash: 382cd1d338c981abb6830e7718651247
MIME type:application/x-dosexec
Signature KongTuke
File name:libGLESv2.dll
File size:1'671'680 bytes
SHA256 hash: 6b07f992baccf35724a47763677fe7f8f55760447f8c6dd485292ecde0ad7ab6
MD5 hash: b3cececcd67b4e1b984421c1506dc705
MIME type:application/x-dosexec
Signature KongTuke
File name:notificationserver.dll
File size:233'984 bytes
SHA256 hash: 6b508d38a64bf2519349d58c9b6f207702240d36b708d85f879e2dc608a7b6e0
MD5 hash: e7e0bd6a59652a7cf572821657921f6b
MIME type:application/x-dosexec
Signature KongTuke
File name:mozavcodec.dll
File size:294'400 bytes
SHA256 hash: 01bda6a152f8b79ca635d1b4cc8e1e2dd7724baadb5c62d4af9d3055e42adf2d
MD5 hash: 47f7cf8d5c53a684b017474f2d7f1eb2
MIME type:application/x-dosexec
Signature KongTuke
File name:mozavutil.dll
File size:237'056 bytes
SHA256 hash: 438f93bee0de18996480254eaa716c2d19673e6f237a5e943886bbc905b50f7e
MD5 hash: 64aa191827afa254cff89db51c68a5b9
MIME type:application/x-dosexec
Signature KongTuke
File name:2
File size:342 bytes
SHA256 hash: d3ba6d7356137377ef02fc0ef15e97b7b4619e18206b83047d758cd1551479ec
MD5 hash: e329183d61421d9516c6db70aa146c22
MIME type:text/xml
Signature KongTuke
File name:msvcp140.dll
File size:553'552 bytes
SHA256 hash: def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 hash: 4e3fa9bd90ef020c14359639dc19312b
MIME type:application/x-dosexec
Signature KongTuke
File name:firefoxupdate.dll
File size:234'496 bytes
SHA256 hash: f0f2f3d690255ff4fcd40253b49b6a3f1f327728bb8c98b8a040ecbef5118a5e
MD5 hash: 24514b2f51d90a5cf9d3ea4e61d22257
MIME type:application/x-dosexec
Signature KongTuke
File name:mozwer.dll
File size:234'496 bytes
SHA256 hash: 8ca765b462123b855b6f1cfbc2d7a8ff14329c9ee104deea8564ba4b95516d6a
MD5 hash: b89686ba9720d0135a6af033f52ed22e
MIME type:application/x-dosexec
Signature KongTuke
File name:lgpllibs.dll
File size:240'128 bytes
SHA256 hash: baa68df8bfc9f263b6b80ee01d471b593a591a967c0821d05046c9ec18b10468
MD5 hash: 17a1c291bfec8d2a5c28491018186f57
MIME type:application/x-dosexec
Signature KongTuke
File name:softokn3.dll
File size:243'712 bytes
SHA256 hash: 79e01dafbb785b19dd0549c831b51a25115afd3048c7e754e8cfe6d0d93745b2
MD5 hash: 4a1e3f4d3e89bf1cc1f907a935954720
MIME type:application/x-dosexec
Signature KongTuke
Vendor Threat Intelligence
Details
Link:
https://research.acce.ciphertechsolutions.com/results/57276633-0a6e-4db3-9452-eaf59af3ca32/
Verdict:
Clean
Score:
99.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=69d6459a6a61012f6ad0109b
Tags:
n/a
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93
Verdict:
Clean
File Type:
zip
Link:
https://opentip.kaspersky.com/2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93/results?tab=lookup
Score:
50%
Verdict:
Susipicious
File Type:
ARCHIVE
Link:
https://malprob.io/report/2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93
Verdict:
inconclusive
YARA:
3 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Zip Archive
Link:
https://app.malva.re/file/094adf26800a7583981600ec680f7eca
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93/
Verdict:
Clean
Link:
https://tip.neiki.dev/file/2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93
Threat name:
Win32.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-06-30 15:10:47 UTC
File Type:
Binary (Archive)
Extracted files:
43
AV detection:
4 of 24 (16.67%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ebs2y4wzav2n7gky4m66l35c3grkpzz7zhm7sqmxnh4fvliihwjq._file
Result
Malware family:
n/a
Score:
  8/10
Tags:
adware persistence ransomware spyware
Link:
https://tria.ge/reports/260630-vcpszadt3x/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:command_and_control
Create hunting rule
Author:CD_R0M_
Description:This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group
Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:DebuggerCheck__QueryInfo
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DebuggerHiding__Thread
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:DetectEncryptedVariants
Create hunting rule
Author:Zinyth
Description:Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded
Rule name:golang_bin_JCorn_CSC846
Create hunting rule
Author:Justin Cornwell
Description:CSC-846 Golang detection ruleset
Rule name:pe_detect_tls_callbacks
Create hunting rule
Rule name:PE_Digital_Certificate
Create hunting rule
Author:albertzsigovits
Rule name:RANSOMWARE
Create hunting rule
Author:ToroGuitar
Rule name:SEH__vectored
Create hunting rule
Reference:https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara
Rule name:SHA512_Constants
Create hunting rule
Author:phoul (@phoul)
Description:Look for SHA384/SHA512 constants
Rule name:Suspicious_Process
Create hunting rule
Author:Security Research Team
Description:Suspicious process creation
Rule name:Sus_All_Windows_PE_Malware
Create hunting rule
Author:DiegoAnalytics
Description:Detects Windows PE malware of all types, avoids non-executables like .html
Rule name:TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE
Create hunting rule
Author:CYFARE
Description:Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:https://cyfare.net/
Rule name:upxHook
Create hunting rule
Author:@r3dbU7z
Description:Detect artifacts from 'upxHook' - modification of UPX packer
Reference:https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/
Rule name:VECT_Ransomware
Create hunting rule
Author:Mustafa Bakhit
Description:Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KongTuke

zip 2065ac72d90574df9958e33de5efa2d9a2a7e73fc9d9f9419769f85aad083d93

(this sample)

  
Link
https://infosec.exchange/@monitorsg/116839689616295210
  
Delivery method
Distributed via web download

Comments