MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 a697b5dc5bb77cb20c044f76b84a03775ab64c72906874ee567b26d070377cb9. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	a697b5dc5bb77cb20c044f76b84a03775ab64c72906874ee567b26d070377cb9
SHA3-384 hash:	94ff9fbb37a1bbda3644b9e5c78a0a2043b608d880df55b67ae64cafa574e4dc17f7fa5a9304eba56a19be9c795c2dd7
SHA1 hash:	956e195f1fcf740e38ca880eb5575a02dcc39e47
MD5 hash:	4ea1acc6673f4b42a980ec1023c2a973
humanhash:	lion-quiet-pizza-happy
File name:	b
Download:	download sample
Signature	KongTuke Alert Create hunting rule
File size:	1'220 bytes
First seen:	2026-09-10 17:13:06 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	12:Qd8UxOVjXypxJ0JOVjXmWYib4WcYvO4m6r4mthgpcpWcYvj4RD6i4RDb5ee5+PAZ:Q+VuV0cVRYifa6jfj4a6/bR6zyn
TLSH	T1A621BBC17949183282A23274D3146052ABCF541B3166FFDE70E296B0AC0E28C92DDBCA
Magika	batch
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://hodkiewhcz[.]sbs/791npnmv.js (ClickFucker) --> hXXps://hodkiewhcz[.]sbs/api/v1/session (token) --> hXXps://hodkiewhcz[.]sbs/api/v1/verify (gateway) --> hXXps://hodkiewhcz[.]sbs/api/v1/status (clipboard) --> hXXps://logincrypt8338[.]com/b (cmd)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

26

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Suspicious

Verdict:

Suspicious

Threat level:

  5/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aa2ef7d558fb3ffa1603738/reports/1b53b085-caaa-48cc-9626-e67f24721dbb/overview

Hybrid Analysis BAT/TrojanDownloader.Agent

Verdict:

Suspicious

Labled as:

BAT/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/a697b5dc5bb77cb20c044f76b84a03775ab64c72906874ee567b26d070377cb9

Nucleon Malprob Susipicious

Score:

55%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/a697b5dc5bb77cb20c044f76b84a03775ab64c72906874ee567b26d070377cb9

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/a697b5dc5bb77cb20c044f76b84a03775ab64c72906874ee567b26d070377cb9/

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=u2l3lxc3w56ledaej53lqsqdo5nlmtdssbuhj3swpmtna4bxps4q._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260910-wjszmstcnc/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/a697b5dc5bb77cb20c044f76b84a03775ab64c72906874ee567b26d070377cb9