78315f36bfe3ac62ec1a69a281be64c0db3614250a7851708813b0739a07842f
78315f36bfe3ac62ec1a69a281be64c0db3614250a7851708813b0739a07842f is a file hash
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from SlowMist.
The report is dated 2026-07-18.
file hash Contagious Interview RESEARCHER POST
Source
-
Transcribed by hand on 27 September 2026 from SlowMist's analysis of a repository a fake Web3 recruiter sent a developer over LinkedIn. The post does not name North Korea. The cluster label rests on the malware: its HMAC key, SuperStr0ngSecret@)@^, and its layout of upload endpoints on ports 8085 and 8086 with a Socket.IO channel and /api/notify on 8087 are the same as in the stealer SANS ISC (diary 33006, 22 May 2026) tied to a DPRK OtterCookie command-and-control address and research.veryserious.systems (13 June 2026) attributed to North Korea's Contagious Interview activity. The repository and its owning account, the command-and-control address, the loader's SHA-256 and its file name are the values the post's IOC section gives; the six endpoint URLs on that address are not carried separately. Values are re-fanged and nothing else is altered.
slowmist.medium.com/threat-intelligence-analysis-of-a-github-poisoning-attack-disguised-as-recruitment-30fe23601305 — SlowMist
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.