MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 27b4c18d2cd3d67f7f08e57d7899323959b66dad2ab9d27a7c6785f401a76476. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	27b4c18d2cd3d67f7f08e57d7899323959b66dad2ab9d27a7c6785f401a76476
SHA3-384 hash:	85ad31f78def9fe6be04f8a68addabe4317c926e600454f2b6757874448401a9cc221c884f3e958021faae2f76ddc526
SHA1 hash:	c97143726c9cfe99a42fa158319f65b4c6cba6df
MD5 hash:	86e41c157c06a34ba704705b25b6dd67
humanhash:	michigan-angel-berlin-thirteen
File name:	b
Download:	download sample
Signature	KongTuke Alert Create hunting rule
File size:	1'196 bytes
First seen:	2026-09-11 15:10:42 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	24:QxVuV0cVRYifQ26d2fj43+Hk6m+HkbR66yn:QxSA26d2fjeV6mVbR6rn
TLSH	T162210F837E80143152B1B1B0D3152456B7D7942B7567F9DAB0D396B8EC0E08EA3ECF91
Magika	batch
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://aatthews[.]cfd/6oll0u79.js (ClickFucker) --> hXXps://aatthews[.]cfd/api/v1/session (token) --> hXXps://aatthews[.]cfd/api/v1/verify (gateway) --> hXXps://aatthews[.]cfd/api/v1/status (clipboard) --> hXXps://winrun2915[.]com/b (cmd)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

81

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

CyberFortress Malicious

Verdict:

Malicious

Score:

94.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6ac9a8a7b34bfb31c9066556

Tags:

virus agent

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aa43b59e2e632a3b46dba28/reports/989d4f94-93e2-446a-84cf-4df4c2bda6e3/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/27b4c18d2cd3d67f7f08e57d7899323959b66dad2ab9d27a7c6785f401a76476

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-11T14:24:00Z UTC

Last seen:

2026-09-12T20:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/27b4c18d2cd3d67f7f08e57d7899323959b66dad2ab9d27a7c6785f401a76476/results?tab=lookup

Nucleon Malprob Malware

Score:

80%

Verdict:

Malware

File Type:

SCRIPT

Link:

https://malprob.io/report/27b4c18d2cd3d67f7f08e57d7899323959b66dad2ab9d27a7c6785f401a76476

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/27b4c18d2cd3d67f7f08e57d7899323959b66dad2ab9d27a7c6785f401a76476/

ReversingLabs TitaniumCloud Script-BAT.Trojan.KongTuke

Threat name:

Script-BAT.Trojan.KongTuke

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-11 17:33:24 UTC

File Type:

Text (Batch)

AV detection:

8 of 24 (33.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=e62mddjm2plh67yi4v6xrgjshfm3m3nnfk45e6t4m6c7ianhmr3a._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260911-v4yj7aybph/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/27b4c18d2cd3d67f7f08e57d7899323959b66dad2ab9d27a7c6785f401a76476