MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 75e60e7b8c9d15a4e2524e6cdf77a4b778bf7908893c5c2e93d88c5a52b25b8a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	75e60e7b8c9d15a4e2524e6cdf77a4b778bf7908893c5c2e93d88c5a52b25b8a
SHA3-384 hash:	c61a0ba0ec774d9c7b51e39a977a601a85b3bf6ab11b9d60b12a29f32891276800b7c184989df023b9b4c3a83a6673be
SHA1 hash:	a633cb22014e3ba0705969aeb88021d8c9271bd3
MD5 hash:	79e88e429f29c0e15a4dc76967e87679
humanhash:	fish-cold-kilo-paris
File name:	b
Download:	download sample
Signature	KongTuke Alert Create hunting rule
File size:	2'298 bytes
First seen:	2026-09-23 14:11:31 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	48:b/Cfdu0duvu/fuPu6uBu4umFuuPiuvurununuEuxuwuSudI23idudG8dza:xbWe2b4xmkurWquuFIpzdI2SEM89a
TLSH	T15241508A310544B2C07631B4774E0E81A3C6A7576A1BFFF1A0D27964BC0BDA193777C5
Magika	batch
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://gerlace[.]com/j9pbhg8j.js (ClickFucker) --> hXXps://gerlace[.]com/api/v1/8e4c615 (token) --> hXXps://gerlace[.]com/api/v1/f659473 (gateway) --> hXXps://gerlace[.]com/api/v1/e81929c (clipboard) --> hXXps://appkey5484[.]com/b (cmd)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

118

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6ab3e235d32e54fd031b167a/reports/100733b4-e127-4c21-b263-299291ddfed2/overview

Hybrid Analysis Unknown

Verdict:

Unknown

Link:

https://www.hybrid-analysis.com/sample/75e60e7b8c9d15a4e2524e6cdf77a4b778bf7908893c5c2e93d88c5a52b25b8a

Kaspersky OpenTIP Unknown

Verdict:

Unknown

File Type:

unix shell

Link:

https://opentip.kaspersky.com/75e60e7b8c9d15a4e2524e6cdf77a4b778bf7908893c5c2e93d88c5a52b25b8a/results?tab=lookup

Nucleon Malprob Susipicious

Score:

33%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/75e60e7b8c9d15a4e2524e6cdf77a4b778bf7908893c5c2e93d88c5a52b25b8a

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/75e60e7b8c9d15a4e2524e6cdf77a4b778bf7908893c5c2e93d88c5a52b25b8a/

ReversingLabs TitaniumCloud Text.Trojan.Generic

Threat name:

Text.Trojan.Generic

Alert

Create hunting rule

Status:

Suspicious

First seen:

2026-09-23 14:29:13 UTC

File Type:

Text (Batch)

AV detection:

3 of 23 (13.04%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=oxta464mtuk2jyssjzwn655ew54l66iire6fylut3cgfuuvslofa._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260923-rtlwvsws6l/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/75e60e7b8c9d15a4e2524e6cdf77a4b778bf7908893c5c2e93d88c5a52b25b8a