2026-09-11 - TRAFFIC ANALYSIS EXERCISE: KONGTUKE REBUKE!

NOTE:

• Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

ASSOCIATED FILE:

• Zip archive of the pcap:  2026-09-11-traffic-analysis-exercise.pcap.zip   54.6 MB (54,624,798 bytes)

BONUS MATERIAL FOR THREAT RESEARCHERS, MALWARE ANALYSTS, AND OTHER SECURITY PROFESSIONALS:

• 2026-09-11-Kongtuke-HTTPS-traffic.zip   97.9 kB (97,937 bytes)
• 2026-09-11-forensic-analysis-files.zip   40.3 MB (40,279,130 bytes)

Shown above: Someone pasting ClickFix-style instructions from a fake verification page into a Run window.

BACKGROUND

I investigated recent Kongtuke ClickFix activity using a domain-joined host in an Active Directory environment.

This exercise provides 3 things:

• A packet capture (pcap) from the infected Windows host.
• Text files with the HTTPS traffic to the Kongtuke domain and the ClickFix script from the fake verification page.
• Malware files and artifacts that I retrieved from the infected Windows host.

We only need the pcap for this exercise.  The additional files are for reverse engineers or threat researchers who want to dig into this more and figure out what the malware is.  If you're not experienced in malware analysis or handling malicious files, just review the pcap.

The characteristics of this environment are:

• LAN segment range:  10.9.11[.]0/24   (10.9.11[.]0 through 10.9.11[.]255)
• Domain:  overhands[.]org
• AD environment name:  OVERHANDS
• Active Directory (AD) domain controller:  10.9.11[.]2 - WIN-GTWXC9UYSE4
• LAN segment gateway:  10.9.11[.]1
• LAN segment broadcast address:  10.9.11[.]255

Armed with the pcap, we can identify the infected host.

YOUR TASK

For this exercise, answer the following questions for your incident report:

• What is the IP address of the infected Windows client?
• What is the MAC address of the infected Windows client?
• What is the host name of the infected Windows client?
• What is the user account name from the infected Windows client?
• What is the full name of the user from the user account?

ANSWERS

• Click here for the answers.

Click here to return to the main page.