← All actor clusters

fcd60ed3712f0f2ce8d5a73f550fdf99de485a1d021ad4ba37ca86672fe09d68

fcd60ed3712f0f2ce8d5a73f550fdf99de485a1d021ad4ba37ca86672fe09d68 is a file hash that one published source reports in connection with APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from MichaelKoczwara. The report is dated 2026-11-07.

file hash APT38 MATCHED IN SOURCE

Listed as fcd60ed3712f...

First seen 2026-11-07 · last seen 2026-11-07

Source

• …Appendix A Full certificate and hash identifiers The two initial leaf certificates differ: 85.137.56.245 leaf SHA-256 fcd60ed3712f0f2ce8d5a73f550fdf99de485a1d021ad4ba37ca86672fe09d68 213.111.148.242 leaf SHA-256 3b87a8b5867c89d2943eeb518436a11c335972ed3f962506025ef4e20bdbfad6 Shared normalized headers mmh3:…

  Tracking Lazarus Group TraderTraitor Infrastructure Through Certificates and Historical Records — MichaelKoczwara · under “Appendix A Full certificate and hash identifiers” · published 2026-11-07 · pulled 2026-11-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Tracking Lazarus Group TraderTraitor Infrastructure Through Certificates and Historical Records

MichaelKoczwara lists 18 other indicators in this source. 12 are shown, chosen across types.

• 37ec4665a8102d115ffd1ac20dae94c98b4dac64b0c1a68228aa2a531caeb35d file hash
• 3b87a8b5867c89d2943eeb518436a11c335972ed3f962506025ef4e20bdbfad6 file hash
• 7350cb4703a96ea7c140bd30da9a6d1bcff36eb2 file hash
• 7b0e49eb35765d1455b506b9b5e7820d18167760 file hash
• b4a66cb1a4981970b8a7084e79b3de7f46bb8cb75cc313768b01e0db8450efa9 file hash
• 185.254.198.90 IP address
• 213.111.148.242 IP address
• 45.11.59.140 IP address
• 45.11.59.184 IP address
• 45.11.59.99 IP address
• 78.141.211.155 IP address
• 85.137.56.161 IP address

All 19 indicators from this source