MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2186a1d4bafc51969dc84c97aafea7231cbbbb55566fca72a5df983060099f5a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

KongTuke

Vendor detections: 6

Intelligence 6 IOCs YARA 16 File information Comments

SHA256 hash:	2186a1d4bafc51969dc84c97aafea7231cbbbb55566fca72a5df983060099f5a
SHA3-384 hash:	2c5b45359b0691f649e8b3d4303c269fe1b1a74049cfa760a600b0485368c0c3ac8e25e318ea042e47d6a1880f8ec40a
SHA1 hash:	5739c8e8744ea87c75bd462c541b926a9cb277d8
MD5 hash:	fa6fabae0e2fc9476bf3f24809da2d77
humanhash:	georgia-hot-six-low
File name:	update-mixed-22001166.zip
Download:	download sample
Signature	KongTuke Create hunting rule
File size:	6'974'837 bytes
First seen:	2026-07-09 22:32:34 UTC
Last seen:	Never
File type:	zip
MIME type:	application/zip
ssdeep	196608:9FeQaKjIJptC5nHq52c8U44UxkdTcZDv5euSQ/8Lix:9FeQRjITmnH42c8vkqZteu3b
TLSH	T15D6633DD06E9652CEF8BBF3E14C430B29340DACA1AC831A05535F532D98D95ABEA0DD7
TrID	60.0% (.USDZ) Universal Scene Description Zipped AR format (generic) (6000/1/1) 40.0% (.ZIP) ZIP compressed archive (4000/1)
Magika	zip
Reporter	aachum
Tags:	ClickFix Kongtuke MintsLoader zip

iamaachum

Compromised website => https://henreques.lol/file.js => https://cloudpass7138.lol/update/package&tar

MintsLoader C2:
http://dht5z2yx50uypbr.top/1.php
Other IOCs:
microcrypt1987.com

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

File Archive Information

This file archive contains 23 file(s), sorted by their relevance:

File name:	xul.dll
File size:	5'719'040 bytes
SHA256 hash:	bd3876fbe91d5d1557baf04230ff69f0c0697e07f78b78b6d110a7bd683c2abe
MD5 hash:	ecc54a6c7f66687e4dcc31d305a0199e
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozglue.manifest
File size:	240 bytes
SHA256 hash:	23680bbba9edbbfab98e27f9bd676b031da3b20adfe909ce86c9ecc1b8bb80d1
MD5 hash:	5d5e62ad6d1023592406fe3ea1f0ea75
MIME type:	text/xml
Signature	KongTuke

File name:	vcruntime140_1.dll
File size:	47'264 bytes
SHA256 hash:	e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
MD5 hash:	03b43160d21c08de07a79d0a1c5ee81d
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	AccessibleMarshal.dll
File size:	233'984 bytes
SHA256 hash:	c6d7c68b40adfaca2204bd5a62d411d8d0b3f29c5d86141a36663ea266da00b8
MD5 hash:	5f1398840861c185c839cf2aa0410db9
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	gkcodecs.dll
File size:	233'472 bytes
SHA256 hash:	bb3f71a24aff91cbcb58c3b7c8a9049ceff9cba2469b7011fb129f76966f7a90
MD5 hash:	5a5ec022cd82fad470fec96e9e8167f8
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozglue.dll
File size:	571'392 bytes
SHA256 hash:	ec335926c09647775506d9d7931bf869272b94bd77b9123ac668ca0050432804
MD5 hash:	67e48f5cd0b75642ba1ebfb0b135f0af
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	plugin-container.exe
File size:	144'512 bytes
SHA256 hash:	653a27b36c41fbb6ac9e7538b481e95b77ebc7eb4f83eb99b4838c81bff64dfa
MD5 hash:	6935302137f3152317eb6a3b4a74f8c5
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	wmfclearkey.dll
File size:	259'072 bytes
SHA256 hash:	7eedadad6be92bd55789d0cfee846af94657a87625eb61ac7d1c8c2a7ae1d1fe
MD5 hash:	e1a051ff44822b2f40f17b0c12592d4a
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	freebl3.dll
File size:	233'472 bytes
SHA256 hash:	5b595c24b8ba63a066f744dbed37bedbd2c4bd9ef1b34e589ff116039a0b93ee
MD5 hash:	b4f28ac259503ce8cf62661281358d24
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozinference.dll
File size:	250'368 bytes
SHA256 hash:	da0f041565bb2efb88ed59b2dae4fde8861e52f7aae1648fbe1c3eefb994072f
MD5 hash:	1243c8a1c375cf06c8d39ed9c1b450e5
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	vcruntime140.dll
File size:	123'472 bytes
SHA256 hash:	184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
MD5 hash:	0d35c5e99871b4f02c490b9fd9dace34
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	nss3.dll
File size:	238'592 bytes
SHA256 hash:	36daf902dc28f582f28d7f7229aad99d11461fc3992208bd3f2b35a02b06d08f
MD5 hash:	7ba044c91e7f52780ca7f46235d105e9
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	libEGL.dll
File size:	1'495'552 bytes
SHA256 hash:	74df4d73ae2e06d23d48e6b483214743e0dbc521fb190e96f278ecdd45938ed2
MD5 hash:	ca05c7fd09191ff23c2c1583a0b21258
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	libGLESv2.dll
File size:	1'671'680 bytes
SHA256 hash:	212ffc04072e2ef3ec7a97f347286522ddf0e89f4384b10e8b124d818177ccb2
MD5 hash:	eb1c94c3fa2d18ef1ca9eb49ab11f712
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	notificationserver.dll
File size:	248'320 bytes
SHA256 hash:	af76ff9d6bca5fcec799cc1d717058832288ad7ca09ec3bb390a09fb697616e2
MD5 hash:	5a5bfe49d000dddb005f7495230c9cb7
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozavcodec.dll
File size:	294'400 bytes
SHA256 hash:	723d0104e7bcf2280e8367b1c487788756be62797f8593374a2697a49b93804b
MD5 hash:	619a9f3384e25be230ad918b9533e015
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozavutil.dll
File size:	237'056 bytes
SHA256 hash:	88986a9d6bd2ba03aff27229ef8b5f6fffa48cd3631e7c9707e0579cfab50b55
MD5 hash:	3d351c37cc1582e7c4a10acbc4fd38ca
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	2
File size:	342 bytes
SHA256 hash:	d3ba6d7356137377ef02fc0ef15e97b7b4619e18206b83047d758cd1551479ec
MD5 hash:	e329183d61421d9516c6db70aa146c22
MIME type:	text/xml
Signature	KongTuke

File name:	msvcp140.dll
File size:	553'552 bytes
SHA256 hash:	def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
MD5 hash:	4e3fa9bd90ef020c14359639dc19312b
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	firefoxupdate.dll
File size:	234'496 bytes
SHA256 hash:	40a03d714c66d3c75c43d568e9c69ef2d4fd295215762c16bf82bf463926f1b2
MD5 hash:	f7c7c01e0c304dcf982dce6250928fac
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	lgpllibs.dll
File size:	233'472 bytes
SHA256 hash:	24205c4322315fac2f813320423579db3a6dc319853dc34297429bf72eb9ccc0
MD5 hash:	b93b2e173737b0c12414fef5d76a4290
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	mozwer.dll
File size:	234'496 bytes
SHA256 hash:	cd3e2438b3051eadba48269813f2576d88d1c40789635cecccef462907e89303
MD5 hash:	ac45839c71f4833ef9fe338de1f70210
MIME type:	application/x-dosexec
Signature	KongTuke

File name:	softokn3.dll
File size:	243'712 bytes
SHA256 hash:	c21ef212bcbb33ba180906bc3c0e49a30a60976b784705078ed402f1f7ddf3eb
MD5 hash:	2acc74c4eddf6e285b323bfdf0ea7a86
MIME type:	application/x-dosexec
Signature	KongTuke

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/0b6e9dc1-dac6-453d-a9b0-e10e80cb59e0/

Detection(s):

SecuriteInfo.com.Win64.Evo-gen.67429834.UNOFFICIAL

Verdict:

Clean

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a022e8c059cfdadce20e141

Tags:

n/a

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/2186a1d4bafc51969dc84c97aafea7231cbbbb55566fca72a5df983060099f5a

Verdict:

Unknown

File Type:

zip

First seen:

2026-07-10T01:48:00Z UTC

Last seen:

2026-07-10T20:09:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/2186a1d4bafc51969dc84c97aafea7231cbbbb55566fca72a5df983060099f5a/results?tab=lookup

Score:

48%

Verdict:

Susipicious

File Type:

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerHiding__Thread Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	PE_Digital_Certificate Create hunting rule
Author:	albertzsigovits

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/

Rule name:	upxHook Create hunting rule
Author:	@r3dbU7z
Description:	Detect artifacts from 'upxHook' - modification of UPX packer
Reference:	https://bazaar.abuse.ch/sample/6352be8aa5d8063673aa428c3807228c40505004320232a23d99ebd9ef48478a/

Rule name:	VECT_Ransomware Create hunting rule
Author:	Mustafa Bakhit
Description:	Detects activity associated with VECT ransomware. This includes registry modifications and deletions, execution of system and defense-evasion commands, suspicious API usage, mutex creation, file and memory manipulation, ransomware note generation, anti-debugging and anti-analysis techniques, and embedded cryptographic constants (SHA256) characteristic of this malware family. Designed for threat intelligence and malware detection environments.