ThreatFox: KongTuke IOCs

Hunt Hypothesis

This hunt targets adversary behavior characterized by the presence of specific threat indicators linked to the KongTuke malware campaign within the Azure environment. Proactively hunting for these IOCs is critical because early detection allows the SOC team to identify compromised assets and mitigate potential data exfiltration before lateral expansion occurs.

IOC Summary

Malware Family: KongTuke Total IOCs: 20 IOC Types: ip:port, domain, url

Type	Value	Threat Type	First Seen	Confidence
ip:port	64[.]95[.]10[.]37:80	botnet_cc	2026-07-07	100%
domain	1yiqsu0s4geu2xc.top	botnet_cc	2026-07-07	100%
domain	53bbwqsrdg3rxni.top	botnet_cc	2026-07-07	100%
domain	855e6v1la8ngbep.top	botnet_cc	2026-07-07	100%
domain	b9yzartkj9dd53v.top	botnet_cc	2026-07-07	100%
domain	fdskeoljs92b0t1.top	botnet_cc	2026-07-07	100%
domain	lkf9soncx2cx8ae.top	botnet_cc	2026-07-07	100%
domain	om8d1tx6uuvmm0m.top	botnet_cc	2026-07-07	100%
domain	q2e2f5xuir4qub8.top	botnet_cc	2026-07-07	100%
domain	sq1y5pp53vljhqs.top	botnet_cc	2026-07-07	100%
domain	vsv1ftyzzn48uhz.top	botnet_cc	2026-07-07	100%
domain	ywomjqqy8nu5p65.top1yiqsu0s4geu2xc.top	botnet_cc	2026-07-07	100%
domain	ywomjqqy8nu5p65.top	botnet_cc	2026-07-07	100%
url	hxxps://lombaidi.lol/file.js	payload_delivery	2026-07-07	100%
domain	lombaidi.lol	payload_delivery	2026-07-07	100%
url	hxxps://lombaidi.lol/api/v1/session	payload_delivery	2026-07-07	100%
url	hxxps://lombaidi.lol/api/v1/verify	payload_delivery	2026-07-07	100%
url	hxxps://lombaidi.lol/api/v1/status	payload_delivery	2026-07-07	100%
url	hxxps://tommy-c.lol/o	payload_delivery	2026-07-07	100%
domain	tommy-c.lol	payload_delivery	2026-07-07	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - KongTuke
let malicious_ips = dynamic(["64.95.10.37"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["64.95.10.37"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Domain Hunt

// Hunt for DNS queries to known malicious domains
// Source: ThreatFox - KongTuke
let malicious_domains = dynamic(["1yiqsu0s4geu2xc.top", "53bbwqsrdg3rxni.top", "855e6v1la8ngbep.top", "b9yzartkj9dd53v.top", "fdskeoljs92b0t1.top", "lkf9soncx2cx8ae.top", "om8d1tx6uuvmm0m.top", "q2e2f5xuir4qub8.top", "sq1y5pp53vljhqs.top", "vsv1ftyzzn48uhz.top", "ywomjqqy8nu5p65.top1yiqsu0s4geu2xc.top", "ywomjqqy8nu5p65.top", "lombaidi.lol", "tommy-c.lol"]);
DnsEvents
| where Name has_any (malicious_domains)
| project TimeGenerated, Computer, Name, IPAddresses, QueryType
| order by TimeGenerated desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - KongTuke
let malicious_urls = dynamic(["https://lombaidi.lol/file.js", "https://lombaidi.lol/api/v1/session", "https://lombaidi.lol/api/v1/verify", "https://lombaidi.lol/api/v1/status", "https://tommy-c.lol/o"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled
DnsEvents	Ensure this data connector is enabled
UrlClickEvents	Ensure this data connector is enabled

References

• ThreatFox — KongTuke

False Positive Guidance

Here are specific false positive scenarios for the ThreatFox: KongTuke IOCs detection rule, tailored for an enterprise environment:

• Security Information and Event Management (SIEM) Content Updates

  • Scenario: The SIEM platform (e.g., Splunk or QRadar) automatically downloads and indexes threat intelligence feeds from vendors like CrowdStrike or AlienVault OTX. These feeds often contain the same IOCs (hashes, URLs) associated with KongTuke that are being cross-referenced by the security team for research purposes, triggering alerts on the SIEM’s own ingestion traffic.
  • Filter/Exclusion: Exclude network flows and file hash events originating from the specific IP addresses of the SIEM collectors or the Threat Intelligence Platform (e.g., Source_IP = 10.50.20.x AND Process_Name = "SplunkForwarder.exe").

• Endpoint Detection and Response (EDR) Scheduled Scans

  • Scenario: During a scheduled weekly deep scan, the EDR agent (e.g., Microsoft Defender for Endpoint or CrowdStrike Falcon) quarantines or flags known test files within the “Security Research” department’s sandbox environment. These test files are intentionally seeded with KongTuke IOCs to validate detection logic, causing legitimate scans to trigger the alert repeatedly at 2:00 AM UTC every Tuesday.
  • Filter/Exclusion: Create a rule exclusion for hosts tagged as Sandbox or Research-Lab during the specific maintenance window (e.g., Host_Group = "Security_Sandbox" AND Time_Window = "Tue 02:00-04:00 UTC").

• Software Deployment via Configuration Management Tools

  • Scenario: The DevOps team utilizes Ansible or SCCM to deploy a new patch package to the Finance