KongTuke Malware - Process from SoftwareProtectionPlatform Path

Daniel Jeremiah@daniyyell

•updated Feb 14, 2026•0•23

Detects KongTuke Python payload or launcher from fake SoftwareProtectionPlatform - Image path must contain SoftwareProtectionPlatform and command line must reference udp.pyw or run.pyw. run.pyw SHA256 6afbe1f38351f6bfdd478240a4792e96f7e2789e5aaf02abbbe2c4c9a368f736, udp.pyw SHA256 efed49010d4da096af63c48a36fb4ca61ac05b4e553bdec6ed76b9590725a99c for correlation.