`3dc840d32ce86cebf657b17cef62814646ba8e98`

3dc840d32ce86cebf657b17cef62814646ba8e98 is a file hash that 4 published sources report in connection with Lazarus Group and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, Volexity, Cyble and Objective-See. The earliest of those reports is dated 2023-03-29 and the most recent 2023-03-31.

file hash Lazarus GroupDPRK (cluster unattributed) MATCHED IN SOURCE

Listed as 3dc840d32ce8...

First seen 2023-03-29 · last seen 2023-03-31

Sources

…5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 0eeb1c0133eb4d571178b2d9d14ce3e9…
36gate: supply chain attack | Group-IB Blog — Group-IB · under “Indicators of compromise” · published 2023-03-31 · pulled 2026-09-11
…Size 164.2MB (172150545 Bytes) File Type Macintosh Disk Image MD5 d5101c3b86d973a848ab7ed79cd11e5a SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 SHA256 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec The backdoor component is libffmpeg.dylib located in…
3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity — Volexity · under “macOS ICONIC Analysis” · published 2023-03-30 · pulled 2026-09-11
…MD5 SHA1 SHA256 3CX macOS Installer File d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec MD5 SHA1 SHA256 3CX macOS Installer File…
Cyble - A Comprehensive Analysis Of The 3CX Attack — Cyble · under “Indicators of Compromise (IOCs)” · published 2023-03-31 · pulled 2026-09-11
…the key to starting our investigation, so a big thanks to them! We’ll start with this disk image, 3CXDesktopApp-18.12.416.dmg ( SHA-1: 3DC840D32CE86CEBF657B17CEF62814646BA8E98 ): Trojanized Disk Image? As you can see, it contains a single application, named “3CX Desktop App”. If we check its code-signing…
Objective-See's Blog — Objective-See · under “Triage” · published 2023-03-29 · pulled 2026-09-11

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: 36gate: supply chain attack | Group-IB Blog

Group-IB lists 46 other indicators in this source. 5 are shown, chosen across types.

All 47 indicators from this source

Cited by the same report: 3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity

Volexity lists 23 other indicators in this source. 4 are shown, chosen across types.

All 24 indicators from this source

Cited by the same report: Cyble - A Comprehensive Analysis Of The 3CX Attack

Cyble lists 60 other indicators in this source. 3 are shown, chosen across types.

All 61 indicators from this source