`cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86`

cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86 is a file hash that 2 published sources report in connection with Lazarus Group, APT38, Andariel and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Unit 42. The earliest of those reports is dated 2024-09-09 and the most recent 2024-09-18.

file hash Lazarus Group APT38 Andariel Kimsuky MATCHED IN SOURCE

Listed as cbf4cfa2d3c3...

First seen 2024-09-09 · last seen 2024-09-18

Sources

…AppleJeus-Related MacOS Variant Another macOS sample (SHA256: cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86 ) we found during pivoting that shared the same encryption key was configured to use rebelthumb.net as the C2 server.…
Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors — Unit 42 · under “AppleJeus-Related MacOS Variant” · published 2024-09-18 · pulled 2026-09-12
…bce1eb513aaac344b5b8f7a9ba9c9e36fc89926d327ee5cc095fb4a895a12f80 bfd74b4a1b413fa785a49ca4a9c0594441a3e01983fc7f86125376fdbd4acf6b cbf4cfa2d3c3fb04fe349161e051a8cf9b6a29f8af0c3d93db953e5b5dc39c86 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd Domains: jdkgradle.com rebelthumb.net…
Threat Assessment: North Korean Threat Groups — Unit 42 · under “PondRAT” · published 2024-09-09 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors

Unit 42 lists 5 other indicators in this source.

Cited by the same report: Threat Assessment: North Korean Threat Groups

Unit 42 lists 41 other indicators in this source. 7 are shown, chosen across types.

All 42 indicators from this source