← All actor clusters

d5101c3b86d973a848ab7ed79cd11e5a

d5101c3b86d973a848ab7ed79cd11e5a is a file hash that 3 published sources report in connection with Lazarus Group and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, Volexity and Cyble. The earliest of those reports is dated 2023-03-30 and the most recent 2023-03-31.

file hash Lazarus GroupDPRK (cluster unattributed) MATCHED IN SOURCE

Listed as d5101c3b86d9...

First seen 2023-03-30 · last seen 2023-03-31

Sources

• …19f4036f5cd91c5fc411afc4359e32f90caddaac 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec…

  36gate: supply chain attack | Group-IB Blog — Group-IB · under “Indicators of compromise” · published 2023-03-31 · pulled 2026-09-11

• …3CXDesktopApp-18.12.416.dmg|3CXDesktopApp-latest.dmg Size 164.2MB (172150545 Bytes) File Type Macintosh Disk Image MD5 d5101c3b86d973a848ab7ed79cd11e5a SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 SHA256 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec The…

  3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity — Volexity · under “macOS ICONIC Analysis” · published 2023-03-30 · pulled 2026-09-11

• …MD5 SHA1 SHA256 3CX macOS Installer File d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec MD5 SHA1 SHA256 3CX macOS…

  Cyble - A Comprehensive Analysis Of The 3CX Attack — Cyble · under “Indicators of Compromise (IOCs)” · published 2023-03-31 · pulled 2026-09-11

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: 36gate: supply chain attack | Group-IB Blog

Group-IB lists 46 other indicators in this source. 5 are shown, chosen across types.

• dde03348075512796241389dfea5560c20a3d2a2eac95c894e7bbed5e85a0acc file hash
• e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec file hash
• f3487a1324f4c11b35504751a5527bc60eb95382 file hash
• f3d4144860ca10ba60f7ef4d176cc736 file hash
• f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 file hash

All 47 indicators from this source

Cited by the same report: 3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity

Volexity lists 23 other indicators in this source. 4 are shown, chosen across types.

• cliego.garcia@proton.me email address
• philip.je@proton.me email address
• https://github.com/iconstorages GitHub account
• https://github.com/neo23x0 GitHub account

All 24 indicators from this source

Cited by the same report: Cyble - A Comprehensive Analysis Of The 3CX Attack

Cyble lists 60 other indicators in this source. 3 are shown, chosen across types.

• d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a file hash
• da667174c2d145a4d9b3b39387fbd7dd file hash
• e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c file hash

All 61 indicators from this source