`bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114`

bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114 is a file hash that 2 published sources report in connection with Kimsuky and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from McAfee and Malwarelab. The earliest of those reports is dated 2020-05-15 and the most recent 2020-07-30.

file hash Kimsuky Lazarus Group MATCHED IN SOURCE

Listed as bff4d04caeaf...

First seen 2020-05-15 · last seen 2020-07-30

Sources

…extracted from the Office files found in the triage phase, the following DLL files: SHA256 Original File name Compile Date bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114 wsuser.db 4/24/2020 b76b6bbda8703fa801898f843692ec1968e4b0c90dfae9764404c1a54abf650b unknown 4/24/2020…
Operation (노스 스타) North Star A Job Offer That’s Too Good to be True? — McAfee · under “Phase Two: Dropping Malicious DLLs” · published 2020-07-30 · pulled 2026-09-12
…"pe" rule apt_NK_Lazarus_DllImplat_cfg_decoder { meta: reference = "https://blog.malwarelab.pl/posts/lazarus_validator/" hash = "bff4d04caeaf8472283906765df34421d657bd631f5562c902e82a3a0177d114" hash = "26a2fa7b45a455c311fd57875d8231c853ea4399be7b9344f2136030b2edc4aa" author = "Maciej Kotowicz, mak@malwarelab.pl" copyright =…
In depth analysis of Lazarus validator — Malwarelab · under “Yara” · published 2020-05-15 · pulled 2026-10-01

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Operation (노스 스타) North Star A Job Offer That’s Too Good to be True?

McAfee lists 2 other indicators in this source.

Cited by the same report: In depth analysis of Lazarus validator

Malwarelab lists 6 other indicators in this source.