Chollima Hunter

← All actor clusters

6dffcfa68433f886b2e88fd984b4995a

6dffcfa68433f886b2e88fd984b4995a is a file hash that 3 published sources report in connection with Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Bae Systems and BAE Systems. The earliest of those reports is dated 2017-02-12 and the most recent 2017-02-20.

file hash Lazarus GroupAPT38 MATCHED IN SOURCE

Listed as 6dffcfa68433...

First seen 2017-02-12 · last seen 2017-02-20

Sources

  • …code comes from a criminal exploit kit which is being leveraged for delivery in this campaign. A similarly named cambio.swf (MD5 hash: 6dffcfa68433f886b2e88fd984b4995a ) was uploaded to VirusTotal from a US IP address in December 2016. IP WHITELISTS When examining the code on the exploit kit website a…
    LAZARUS & WATERING-HOLE ATTACKS — Bae Systems · under “SILVERLIGHT XAP FILE” · published 2017-02-12 · pulled 2026-09-12
  • …code comes from a criminal exploit kit which is being leveraged for delivery in this campaign. A similarly named cambio.swf (MD5 hash: 6dffcfa68433f886b2e88fd984b4995a ) was uploaded to VirusTotal from a US IP address in December 2016. IP WHITELISTS When examining the code on the exploit kit website a…
    LAZARUS & WATERING-HOLE ATTACKS — Bae Systems · under “SILVERLIGHT XAP FILE” · published 2017-02-12 · pulled 2026-09-27
  • …9216b29114fb6713ef228370cbfe4045 8e32fccd70cec634d13795bcb1da85ff 889e320cf66520485e1a0475107d7419 6dffcfa68433f886b2e88fd984b4995a Filenames cambio.swf cambio.xap mark180789172360.ico meml102783047891.dat back283671047171.dat URLs…
    LAZARUS’ FALSE FLAG MALWARE — BAE Systems · under “APPENDIX A: INDICATORS OF COMPROMISE” · published 2017-02-20 · pulled 2026-10-01

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: LAZARUS & WATERING-HOLE ATTACKS

Bae Systems lists 11 other indicators in this source. 5 are shown, chosen across types.

All 12 indicators from this source

Cited by the same report: LAZARUS & WATERING-HOLE ATTACKS

Bae Systems lists 11 other indicators in this source. 4 are shown, chosen across types.

All 12 indicators from this source

Cited by the same report: LAZARUS’ FALSE FLAG MALWARE

BAE Systems lists 6 other indicators in this source. 3 are shown, chosen across types.

All 7 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.