`166d1a6ddcde4e859a89c2c825cd3c8c953a86bfa92b343de7e5bfbfb5afb8be`

166d1a6ddcde4e859a89c2c825cd3c8c953a86bfa92b343de7e5bfbfb5afb8be is a file hash that one published source reports in connection with unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Microsoft. The report is dated 2023-11-22.

file hash DPRK (cluster unattributed) MATCHED IN SOURCE

Listed as 166d1a6ddcde...

First seen 2023-11-22 · last seen 2023-11-22

Source

…and protections to identify past related activity and prevent future attacks against their systems. Indicator Type Description 166d1a6ddcde4e859a89c2c825cd3c8c953a86bfa92b343de7e5bfbfb5afb8be SHA-256 Trojanized CyberLink installer (LambLoad) 089573b3a1167f387dcdad5e014a5132e998b2c89bff29bcf8b06dd497d4e63d SHA-256 Second-stage…
Diamond Sleet supply chain compromise distributes a modified CyberLink installer — Microsoft · under “Indicators of compromise” · published 2023-11-22 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Diamond Sleet supply chain compromise distributes a modified CyberLink installer

Microsoft lists 3 other indicators in this source.