KongTuke: K is for Keylogging and Kidnapping Your Data
KongTuke is a recent, aggressive campaign that delivers a modified Interlock RAT (PHP variant) via a PyInstaller packed payload.
Unveiling the KongTuke campaign a modified Interlock RAT variant and how we map its infrastructure to stop it cold.
KongTuke is a recent, aggressive campaign that delivers a modified Interlock RAT (PHP variant) via a PyInstaller packed payload. This campaign shows how modern attackers chain packer evasion, malicious imports, and resilient C2 infrastructure to maintain persistence and extract value from victims. Below we present a clear infrastructure map (no tool names mentioned) and actionable steps you can take now including a ready to use IOC block table so your organization can defend itself.
Quick forensic snapshot
Malware name: KongTuke
SHA256: 2EABE990F91BFC480C09DB02A4DE43116B40DA2D6EAAD00A034ADF4214DAC4D1
VirusTotal detections: 40 (malicious)
Total malicious imports observed: 27
Example malicious imports: GetCurrentProcessId, GetCurrentProcess, WriteFile, OpenProcessToken, GetTokenInformation
Signature: Unknown
Packer: PyInstaller (modified)
Heuristic/packed indicators: Compressed or packed data; strange overlay; section 4 (.rsrc) compressed
When examined in PeStudio it looks like: a PyInstallerpacked executable with a compressed resource overlay, many suspicious imports flagged (27), and indicators consistent with staged dropper / loader behavior.
Infrastructure map how KongTuke operates
Victim Email/Phish → Malicious Attachment (PyInstallerpacked)
↓ execute
Loader / Dropper (modified PyInstaller) → Unpacks payload (Interlock RAT PHP variant)
↓ beaconing / persistence
C2 Domains (trycloudflare subdomains) ↔ Fallback IPs (64.95.12.71 / 184.95.51.165)
↓ commands / data exfiltration
Data staging → Exfil over HTTP(S) / fallback channels
(Think of it as: Delivery → Execution → Persistence → C2 → Exfiltration.)
Key defensive control points: email gateway & attachment analysis, endpoint unpacking/dynamic analysis, network DNS+IP blocking, detection of PyInstaller overlays and suspicious import patterns, and rapid containment of hosts that beacon to those domains/IPs.
IOC block table add these to your firewalls, DNS filters, EDR/AV blocklists and SIEM rules
File hashes
| Type | Value |
|---|---|
| SHA-256 (KongTuke sample) | 2EABE990F91BFC480C09DB02A4DE43116B40DA2D6EAAD00A034ADF4214DAC4D1 |
| Sample Hash A | 07295b78c83edcd3fa3706543e5d7347c5571bfb7f096f5e43f43dd28a0ec2d5 |
| Sample Hash B | 655978103abbe7aedd62e0a8f289ada133302230f12edbb84abe5a1a31eab3b3 |
| Sample Hash C | 92fea18ddd79fd92aa50d8d240f8f86729692f80df490ec4bf46652fd3051755 |
| Sample Hash D | c24d6a9de8f394854e91a84ece64e9a5a8fcc8b66e7e67ac47473e5cf709cfde |
| Sample Hash E | cf55a26b7f3c716084dcbc1629203377699e8dd5628f8ea90154027d833082c8 |
| Sample Hash F | d1ec03ee9e5e8abb91612d33e0658969ccca25b5e068a16cb1f2fe9b21801277 |
C2 Domains (Interlock RAT PHP variant)
| Domain |
|---|
existed-bunch-balance-councils[.]trycloudflare[.]com |
ferrari-rolling-facilities-lounge[.]trycloudflare[.]com |
galleries-physicians-psp-wv[.]trycloudflare[.]com |
evidence-deleted-procedure-bringing[.]trycloudflare[.]com |
nowhere-locked-manor-hs[.]trycloudflare[.]com |
ranked-accordingly-ab-hired[.]trycloudflare[.]com |
C2 / fallback IPs
| IP |
|---|
64[.]95[.]12[.]71 |
184[.]95[.]51[.]165 |
Detection & response guidance
We present the infrastructure map to find, isolate, and remediate infections quickly. Key actions we recommend and deliver as a service:
1. Immediate network defenses
Block the domains and IPs above at DNS, proxy and firewall layers.
Blacklist the provided hashes in AV/EDR and quarantine matching files.
2. Endpoint triage and hunt
Search endpoints for PyInstaller artifacts and the listed SHA256s.
Look for processes importing suspicious APIs (the 27 flagged imports) and for compressed .rsrc overlays.
3. Containment & eradication
Isolate infected hosts, capture volatile evidence, and remove persistence (scheduled tasks, services, web shells).
Reset credentials tied to compromised accounts and rotate keys.
4. Network forensics
Review DNS logs and proxy logs for beacons to the trycloudflare subdomains and the fallback IPs.
Identify lateral spread and exfil channels.
5. Hunting & detection rules
Create correlation rules in SIEM for: PyInstaller artifacts + suspicious imports + connections to the listed domains/IPs.
Deploy YARA signatures for PyInstaller overlay patterns observed and for the specific hashes above.
6. User education & prevention
Simulated phishing campaigns, tighter attachment handling, and stricter filtering on executable attachments.
Why map infrastructure (and why it matters)
KongTuke is not just a single file it’s an ecosystem (packer/loader + RAT + resilient C2). Blocking a single artifact is useful, but mapping how components interact lets you break the campaign at multiple points (delivery, unpacking, network beaconing), reducing dwell time and preventing reinfection.
Want us to map your exposure?
We can ingest your endpoint telemetry and network logs, run the infrastructure mapping and deliver:
A prioritized IOC blocklist ready for your devices,
Hostlevel remediation playbooks,
A containment timeline and attacker TTP mapping tied to your environment.
If you’d like, send over your logs (or let us connect to your SIEM/EDR) and we’ll produce a tailored infrastructure map and an action plan within a single engagement.
