🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e76ce6873ad4f590b85c6521e44c5b491a6a0ed2f0943e1c91ada996640bc042. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


KongTuke


Vendor detections: 6


Intelligence 6 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e76ce6873ad4f590b85c6521e44c5b491a6a0ed2f0943e1c91ada996640bc042
SHA3-384 hash: 91e0290726903a5a2b5ccc9873188c0f2249e1a39938294187ddcfe70e141fe14331e40c523c815f34357e1dd537863e
SHA1 hash: 922048fee73375e4f127618593f021747cb31e8e
MD5 hash: 59a2141031e0dd133ab46a1254c16e38
humanhash: idaho-bravo-vegan-video
File name:b
Download: download sample
Signature KongTuke
Create hunting rule
File size:1'202 bytes
First seen:2026-09-07 19:12:19 UTC
Last seen:Never
File type:PowerShell (PS) ps1
MIME type:text/plain
ssdeep 24:QjsSVuV0cVRYifMswm6Vswmfj43swF6CswFbR6xOyn:QjsSScswm6VswmfjqswF6CswFbR6x/n
TLSH T16621CD427640143242A13170D3493562B7D7F94F75E6B9D9B0F2AAF0AC1D08863EDF92
Magika batch
Reporter monitorsg
Tags:Kongtuke ps1


Avatar
monitorsg
hXXps://schamserger[.]top/omc863el.js (ClickFucker) --> hXXps://schamserger[.]top/api/v1/session (token) --> hXXps://schamserger[.]top/api/v1/verify (gateway) --> hXXps://schamserger[.]top/api/v1/status (clipboard) --> hXXps://opsbyte3368[.]com/b (cmd) --> hXXps://opsbyte3368[.]com/ue (cmd)

Intelligence

File Origin
# of uploads :
1
# of downloads :
90
Origin country :
US US
Vendor Threat Intelligence
No detections
Verdict:
Malicious
Score:
92.5%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6ac7561b45c1fe67f5d0ffcd
Tags:
trojan virus
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Link:
https://www.filescan.io/uploads/6a9f0f5e3491aff943bb0679/reports/c7af4460-3fd4-4063-aa65-8a7cb06ffb92/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e76ce6873ad4f590b85c6521e44c5b491a6a0ed2f0943e1c91ada996640bc042
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-09-07T18:06:00Z UTC
Last seen:
2026-09-08T19:23:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/e76ce6873ad4f590b85c6521e44c5b491a6a0ed2f0943e1c91ada996640bc042/results?tab=lookup
Score:
80%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e76ce6873ad4f590b85c6521e44c5b491a6a0ed2f0943e1c91ada996640bc042
Gathering data
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e76ce6873ad4f590b85c6521e44c5b491a6a0ed2f0943e1c91ada996640bc042/
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=45wonbz22t2zboc4muq6itc3jengudws6ckd4hervwuzmzalybba._file
Result
Malware family:
n/a
Score:
  3/10
Tags:
execution
Link:
https://tria.ge/reports/260907-x4gmsafk4x/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Command and Scripting Interpreter: PowerShell
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e76ce6873ad4f590b85c6521e44c5b491a6a0ed2f0943e1c91ada996640bc042

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

KongTuke

PowerShell (PS) ps1 e76ce6873ad4f590b85c6521e44c5b491a6a0ed2f0943e1c91ada996640bc042

(this sample)

  
Delivery method
Distributed via web download

Comments