`a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67`

a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 is a file hash that 4 published sources report in connection with Lazarus Group, unclustered DPRK, APT38, Andariel and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, Volexity, Symantec and Unit 42. The earliest of those reports is dated 2023-03-30 and the most recent 2024-09-09.

file hash Lazarus GroupDPRK (cluster unattributed)APT38 Andariel Kimsuky MATCHED IN SOURCE

Listed as a64fa9f1c764...

First seen 2023-03-30 · last seen 2024-09-09

Sources

…660ea9b8205fbd2da59fefd26ae5115c 769383fc65d1386dd141c960c9970114547da0c2 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 82187ad3f0c6c225e2fba0c867280cc9 20d554a80d759c50d6537dd7097fed84dd258b3e…
36gate: supply chain attack | Group-IB Blog — Group-IB · under “Indicators of compromise” · published 2023-03-31 · pulled 2026-09-11
…Bytes) File Type Mach-O MD5 660ea9b8205fbd2da59fefd26ae5115c SHA1 769383fc65d1386dd141c960c9970114547da0c2 SHA256 a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 The macOS version does not use GitHub to retrieve its C2 server.…
3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity — Volexity · under “macOS ICONIC Analysis” · published 2023-03-30 · pulled 2026-09-11
…There are at least two variants of this file (SHA256: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 and fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7) and they seem to relate to different versions of the software.…
3CX: Supply Chain Attack Affects Thousands of Users Worldwide | SECURITY.COM — Symantec · under “Mac versions” · published 2023-03-31 · pulled 2026-09-11
…3CX DMG SHA256 hash: e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec libffmpeg.dy SHA256 hashes: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 479038eb12ed07893ee0dcc04fbdcf182489bbb271f5a4f90f83874881a80ce3 2546d239a262c24a6f8ea01d890cbc459a22db79b379b6ec3b24fbb56efb5381…
Threat Assessment: North Korean Threat Groups — Unit 42 · under “libffmpeg.dy” · published 2024-09-09 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: 36gate: supply chain attack | Group-IB Blog

Group-IB lists 46 other indicators in this source. 5 are shown, chosen across types.

All 47 indicators from this source

Cited by the same report: 3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity

Volexity lists 23 other indicators in this source. 4 are shown, chosen across types.

All 24 indicators from this source

Cited by the same report: 3CX: Supply Chain Attack Affects Thousands of Users Worldwide | SECURITY.COM

Symantec lists 2 other indicators in this source. 1 are shown, chosen across types.

All 3 indicators from this source