MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dbac862805f4b4e1b426ed441bf4c4d2c9523ef17189759294f2d3cfeb88e9a2. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	dbac862805f4b4e1b426ed441bf4c4d2c9523ef17189759294f2d3cfeb88e9a2
SHA3-384 hash:	1b4cbe91d0353feaf8ad4ed15c3e09afc14b0a0786da3c3e0cec089654b2469b1a78ef92e11600d3a425be41e097d843
SHA1 hash:	98152a4f5a02c08f40c12e6bd5b9f0dbbe4a297f
MD5 hash:	5d719acb97e687935689b91a5f77889e
humanhash:	louisiana-seven-football-gee
File name:	b
Download:	download sample
Signature	KongTuke Alert Create hunting rule
File size:	1'196 bytes
First seen:	2026-09-11 20:09:08 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	24:QDjVuV0cVRYifoFz6JFzfj4fF46aF4bR62bWukyn:QDjS4Fz6JFzfjSF46aF4bR62yWn
TLSH	T1BD21ED923A45143143A53170D35A3553BAE7691B3367BAC8B8D286B0AC0D18D63ACF96
Magika	batch
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://roeerts[.]cfd/zazk56xt.js (ClickFucker) --> hXXps://roeerts[.]cfd/api/v1/session (token) --> hXXps://roeerts[.]cfd/api/v1/verify (gateway) --> hXXps://roeerts[.]cfd/api/v1/status (clipboard) --> hXXps://syshex6495[.]com/b (cmd)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

23

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

FileScan.IO Unknown

Verdict:

Unknown

Threat level:

n/a  -.1.0/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aa50007a586d152b561cf4e/reports/3f22d046-efb6-4d11-a192-8f5d28a4e0f3/overview

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-11T18:52:00Z UTC

Last seen:

2026-09-12T20:04:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/dbac862805f4b4e1b426ed441bf4c4d2c9523ef17189759294f2d3cfeb88e9a2/results?tab=lookup

Nucleon Malprob Susipicious

Score:

62%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/dbac862805f4b4e1b426ed441bf4c4d2c9523ef17189759294f2d3cfeb88e9a2

Malva.RE

Gathering data

CERT.PL MWDB

Gathering data

ReversingLabs TitaniumCloud Script-BAT.Trojan.KongTuke

Threat name:

Script-BAT.Trojan.KongTuke

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-12 04:39:01 UTC

File Type:

Text (Batch)

AV detection:

12 of 38 (31.58%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=3owimkaf6s2odnbg5vcbx5ge2levepxrogexleuu6lj4724i5gra._file

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/dbac862805f4b4e1b426ed441bf4c4d2c9523ef17189759294f2d3cfeb88e9a2