`7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896`

7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 is a file hash that 4 published sources report in connection with Lazarus Group and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, Volexity, Cyble and Symantec. The earliest of those reports is dated 2023-03-30 and the most recent 2023-03-31.

file hash Lazarus GroupDPRK (cluster unattributed) MATCHED IN SOURCE

Listed as 7986bbaee894...

First seen 2023-03-30 · last seen 2023-03-31

Sources

…74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 f3d4144860ca10ba60f7ef4d176cc736 bea77d1e59cf18dce22ad9a2fad52948fd7a9efa…
36gate: supply chain attack | Group-IB Blog — Group-IB · under “Indicators of compromise” · published 2023-03-31 · pulled 2026-09-11
…Bytes) File Type Win32 DLL MD5 74bc2d0b6680faa1a5a76b27e5479cbc SHA1 bf939c9c261d27ee7bb92325cc588624fca75429 SHA256 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 The library is loaded by 3CXDesktopApp.exe , and it is used to decode and inject a payload into memory: Name(s) N/A Size…
3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity — Volexity · under “Stage #1: Supply Chain Attacks – ICONIC” · published 2023-03-30 · pulled 2026-09-11
…MD5 SHA1 SHA256 Malicious DLL 74bc2d0b6680faa1a5a76b27e5479cbc bf939c9c261d27ee7bb92325cc588624fca75429 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 MD5 SHA1 SHA256 Malicious DLL cad1120d91b812acafef7175f949dd1b09c6c21a SHA1 Stealer Payload…
Cyble - A Comprehensive Analysis Of The 3CX Attack — Cyble · under “Indicators of Compromise (IOCs)” · published 2023-03-31 · pulled 2026-09-11
…the clean executable was used to load a malicious DLL named ffmpeg.dll (SHA256: 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896) This DLL contains code that will load and execute a payload from a second DLL named d3dcompiler_47.dll.…
3CX: Supply Chain Attack Affects Thousands of Users Worldwide | SECURITY.COM — Symantec · under “Attack chain” · published 2023-03-31 · pulled 2026-09-11

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: 36gate: supply chain attack | Group-IB Blog

Group-IB lists 46 other indicators in this source. 5 are shown, chosen across types.

All 47 indicators from this source

Cited by the same report: 3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity

Volexity lists 23 other indicators in this source. 4 are shown, chosen across types.

All 24 indicators from this source

Cited by the same report: Cyble - A Comprehensive Analysis Of The 3CX Attack

Cyble lists 60 other indicators in this source. 3 are shown, chosen across types.

All 61 indicators from this source