`99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd`

99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd is a file hash that 2 published sources report in connection with Andariel activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cyberpoking and Microsoft. The earliest of those reports is dated 2022-07-14 and the most recent 2024-03-17.

file hash Andariel MATCHED IN SOURCE

Listed as 99fc54786a72...

First seen 2022-07-14 · last seen 2024-03-17

Sources

…variant of H0lyGh0st ransomware binaries." last_modified = "2024-03-17" author = "@petermstewart" DaysofYara = "77/100" sha256 = "99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd" ref = "https://blogs.blackberry.com/en/2022/08/h0lygh0st-ransomware" strings: $pdb = "M:\\ForOP\\attack(utils)\\attack…
H0lyGh0st (SiennaPurple) Ransomware — Cyberpoking · under “#100DaysofYARA 2024 – Day 77 – H0lyGh0st (SiennaPurple) Ransomware” · published 2024-03-17 · pulled 2026-09-12
…and protections to identify past related activity and prevent future attacks against their systems. Indicator Type Description 99fc54786a72f32fd44c7391c2171ca31e72ca52725c68e2dde94d04c286fccd SHA-256 Hash of BTLC_C.exe f8fc2445a9814ca8cf48a979bff7f182d6538f4d1ff438cf259268e8b4b76f86 SHA-256 Hash of HolyRS.exe…
North Korean threat actor targets small and midsize businesses with H0lyGh0st ransomware — Microsoft · under “Indicators of compromise” · published 2022-07-14 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: H0lyGh0st (SiennaPurple) Ransomware

Cyberpoking lists 1 other indicator in this source.

Cited by the same report: North Korean threat actor targets small and midsize businesses with H0lyGh0st ransomware

Microsoft lists 4 other indicators in this source. 3 are shown, chosen across types.

All 5 indicators from this source