MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e5eba0c505759a2ddd4a03332caf54ee531a062dacf19c12c015221ab3065aad. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

SHA256 hash:	e5eba0c505759a2ddd4a03332caf54ee531a062dacf19c12c015221ab3065aad
SHA3-384 hash:	5b2afdd74ecf3bfc8ababf10590c6436c2649810480a225aaa71d0762556b1635ac13146dc8c02535e1d2f63ed3471cb
SHA1 hash:	2d71e447c5ad42084a52f5e7e07bef0b0850a339
MD5 hash:	4287f1ced950519bfdd76177d0139726
humanhash:	paris-north-pluto-pip
File name:	b
Download:	download sample
Signature	KongTuke Alert Create hunting rule
File size:	1'196 bytes
First seen:	2026-09-11 17:37:46 UTC
Last seen:	Never
File type:	ps1
MIME type:	text/plain
ssdeep	24:QDjVuV0cVRYifoFqik6JFqikfj4fFqk6aFqkbR6Zkyn:QDjS4FDk6JFDkfjSFD6aFDbR6nn
TLSH	T18021ED423A40143543A975B0D3462053B7EF7C1B32A7F9C8B8D686B0AC0D28DA3DCF96
Magika	batch
Reporter	monitorsg
Tags:	Kongtuke ps1

monitorsg

hXXps://roeerts[.]cfd/mfmop46p.js (ClickFucker) --> hXXps://roeerts[.]cfd/api/v1/session (token) --> hXXps://roeerts[.]cfd/api/v1/verify (gateway) --> hXXps://roeerts[.]cfd/api/v1/status (clipboard) --> hXXps://syshex6495[.]com/b (cmd)

Intelligence

---

File Origin

# of uploads :

1

# of downloads :

73

Origin country :

US

Vendor Threat Intelligence

ACCE Unknown

No detections

ClamAV Detected

Detection(s):

SecuriteInfo.com.BAT.DownLoader.1395.8867.29541.UNOFFICIAL

Alert

Create hunting rule

FileScan.IO Malicious

Verdict:

Malicious

Threat level:

  10/10

Confidence:

100%

Link:

https://www.filescan.io/uploads/6aa44046957fde7c9c8f0e18/reports/835fd7f5-084e-4fed-8484-c1ba67b88d1a/overview

Hybrid Analysis BAT/TrojanDownloader.Agent

Verdict:

Suspicious

Labled as:

BAT/TrojanDownloader.Agent

Link:

https://www.hybrid-analysis.com/sample/e5eba0c505759a2ddd4a03332caf54ee531a062dacf19c12c015221ab3065aad

Kaspersky OpenTIP Malicious

Verdict:

Malicious

File Type:

unix shell

First seen:

2026-09-11T16:45:00Z UTC

Last seen:

2026-09-11T17:01:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/e5eba0c505759a2ddd4a03332caf54ee531a062dacf19c12c015221ab3065aad/results?tab=lookup

Nucleon Malprob Susipicious

Score:

67%

Verdict:

Susipicious

File Type:

SCRIPT

Link:

https://malprob.io/report/e5eba0c505759a2ddd4a03332caf54ee531a062dacf19c12c015221ab3065aad

Malva.RE

Gathering data

CERT.PL MWDB

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/e5eba0c505759a2ddd4a03332caf54ee531a062dacf19c12c015221ab3065aad/

ReversingLabs TitaniumCloud Script-BAT.Trojan.KongTuke

Threat name:

Script-BAT.Trojan.KongTuke

Alert

Create hunting rule

Status:

Malicious

First seen:

2026-09-11 17:54:55 UTC

File Type:

Text (Batch)

AV detection:

3 of 36 (8.33%)

Threat level:

  5/5

Spamhaus Hash Blocklist Suspicious file

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=4xv2brifownc3xkkamzszl2u5zjrubrnvtyzyewacurbvmyglkwq._file

Hatching Triage Unknown

Result

Malware family:

n/a

Score:

  3/10

Tags:

execution

Link:

https://tria.ge/reports/260911-wgy3waar9w/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Command and Scripting Interpreter: PowerShell

VirusTotal

Please note that we are no longer able to provide a coverage score for Virus Total.

YOROI YOMI Legit

Threat name:

Legit

Score:

0.00

Link:

https://yomi.yoroi.company/submissions/e5eba0c505759a2ddd4a03332caf54ee531a062dacf19c12c015221ab3065aad