hxxp://temp[.]sh/utDKu/138d2a62b73e89fc4d09416bcefed27e139ae90016ba4493efc5fbf43b66acfa.exeURL
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 9 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Dissecting CrashFix: KongTuke's New Toy“After a brief sleep, the script downloads an executable from hxxp://temp[.]sh/utDKu/138d2a62b73e89fc4d09416bcefed27e139ae90016ba4493efc5fbf43b66acfa.exe, saves it to %TEMP%\aa.exe, and immediately executes it.”
Indicators reported together
named in the same reports- 158.247.252[.]178in 1 report
- 170.168.103[.]208in 1 report
- hxxps://github[.]com/uBlockOrigin/uBOL-homein 1 report
- hxxps://nexsnield[.]com/install?uuid=550e8400-e29b-41d4-a716-446655440000&version=2025.1116.1842in 1 report
- nexsnield[.]comin 1 report
- hxxps://nexsnield[.]com/update?uuid=550e8400-e29b-41d4-a716-446655440000&version=2025.1116.1842&previous=2025.1115.1000in 1 report
- hxxp://199.217.98[.]108/bin 1 report
- 199.217.98[.]108in 1 report
- hxxp://fyvw2oiv[.]top/1.php?s=63e95be1-92e0-45c1-a928-65d63b17cd1cin 1 report
- fyvw2oiv[.]topin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/cb9c57145f4b6afbc08f24a19257ed5a/raw/e1be0cc7b7e58e4205920c019d786db636036a4c/kongtuke_dga.txtin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/54725bf9a7809ef480fc5e35a7521137/raw/d0a0e04504fa0e1e91850be141c9bb23608b73d7/aes256_cbc.txtin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/6aa1e36457d6dbc09ff7dd218c7c223b/raw/5e186b23d4eecd7b3b99f8b88178545ade747cd8/example.txtin 1 report
- hxxps://gist.githubusercontent[.]com/RussianPanda95/71164efdc4d7e816b385551b38ada5ca/raw/2c9baaf2105dc7f730c6d562472780bd5535c32d/xor.txtin 1 report
- fbfce492d1aa458c…7f59db67de67in 1 report
- 6399c686eba09584…7ce7c27752f4in 1 report
- hxxps://www.dropbox[.]com/scl/fi/6gscgf35byvflw4y6x4i0/b1.zip?rlkey=bk2hvxvw53ggzhbjiftppej50&st=yyxnfu71&dl=1in 1 report
- c15f44d6abb3a2a8…bfba5832c8c6in 1 report
- c46af9ae6ab0e756…45fe7640199cin 1 report
- hxxps://github[.]com/RussianPanda95/Yara-Rules/blob/main/KongTuke/gatekeeper_payload.yarin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.