`bfecb8ce89a312d2ef4afc64a63847ae11c6f69e`

bfecb8ce89a312d2ef4afc64a63847ae11c6f69e is a file hash that 4 published sources report in connection with Lazarus Group, Contagious Interview and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, ReversingLabs, Volexity and Cyble. The earliest of those reports is dated 2023-03-30 and the most recent 2023-03-31.

file hash Lazarus Group Contagious InterviewDPRK (cluster unattributed) MATCHED IN SOURCE

Listed as bfecb8ce89a3...

First seen 2023-03-30 · last seen 2023-03-31

Sources

…e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 3703770e32820397c6e7e1e1221e6d0d…
36gate: supply chain attack | Group-IB Blog — Group-IB · under “Indicators of compromise” · published 2023-03-31 · pulled 2026-09-11
…filename sha1 3cxdesktopapp-18.12.407.msi bea77d1e59cf18dce22ad9a2fad52948fd7a9efa 3cxdesktopapp-18.12.416.msi bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 3CXDesktopApp-18.12.416-full.nupkg f7f1b34c2770d83e2250e19c8425a4bec56617fd 3CXDesktopApp_v18.12.407.0.exe…
Red flags flew over software supply chain-compromised 3CX update | RL Blog — ReversingLabs · under “Indicators of Compromise (IOC) list” · published 2023-03-30 · pulled 2026-09-11
…Size 97.8MB (102555648 Bytes) File Type Windows Installer MD5 0eeb1c0133eb4d571178b2d9d14ce3e9 SHA1 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e SHA256 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 The installer contains a malicious version of…
3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity — Volexity · under “Stage #1: Supply Chain Attacks – ICONIC” · published 2023-03-30 · pulled 2026-09-11
…MD5 SHA1 SHA256 3CX Windows Installer 0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 MD5 SHA1 SHA256 3CX Windows Installer…
Cyble - A Comprehensive Analysis Of The 3CX Attack — Cyble · under “Indicators of Compromise (IOCs)” · published 2023-03-31 · pulled 2026-09-11

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: 36gate: supply chain attack | Group-IB Blog

Group-IB lists 46 other indicators in this source. 5 are shown, chosen across types.

All 47 indicators from this source

Cited by the same report: Red flags flew over software supply chain-compromised 3CX update | RL Blog

ReversingLabs lists 2 other indicators in this source.

Cited by the same report: 3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity

Volexity lists 23 other indicators in this source. 5 are shown, chosen across types.

All 24 indicators from this source