`da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4`

da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4 is a file hash that 3 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Snyk, Socket and Kieran Miyamoto (kmsec). The earliest of those reports is dated 2026-02-26 and the most recent 2026-03-12.

file hash Contagious Interview MATCHED IN SOURCE

Listed as da1775d0fbe9...

First seen 2026-02-26 · last seen 2026-03-12

Sources

…uuindex, vitetest-lint, windowston, zoddle) Every package contains identical malicious code at vendor/scrypt-js/version.js (SHA256: da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4 ).…
Inside StegaBin: How a DPRK Steganography Campaign Generated Headlines | Snyk — Snyk · under “The packages” · published 2026-03-12 · pulled 2026-09-09
…throwaway accounts over February 25 - 26, 2026. All packages share a single malicious file at vendor/scrypt-js/version.js (SHA256: da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4 ). The loader extracts C2 URLs steganographically encoded within three Pastebin pastes, innocuous computer science essays in which…
StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer | Socket — Socket · under “At a Glance #” · published 2026-02-27 · pulled 2026-09-12
…the shout-out Socket! All seventeen packages contain an identical malicious JavaScript file at vendor/scrypt-js/version.js . sha256 da1775d0fbe99fbc35b6f0b4a3a3cb84da3ca1b2c1bbac0842317f6f804e30a4 view raw sample — it’s highly obfuscated, my analysis is further below. Date Package npm user 2026-02-26 10:35:55 daytonjs v1.11.20…
Novel DPRK stager using Pastebin and text steganography — Kieran Miyamoto (kmsec) · under “Summary” · published 2026-02-26 · pulled 2026-10-01

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Inside StegaBin: How a DPRK Steganography Campaign Generated Headlines | Snyk

Snyk lists 7 other indicators in this source. 5 are shown, chosen across types.

All 8 indicators from this source

Cited by the same report: StegaBin: 26 Malicious npm Packages Use Pastebin Steganography to Deploy Multi-Stage Credential Stealer | Socket

Socket lists 12 other indicators in this source. 4 are shown, chosen across types.

All 13 indicators from this source

Cited by the same report: Novel DPRK stager using Pastebin and text steganography

Kieran Miyamoto (kmsec) lists 22 other indicators in this source. 3 are shown, chosen across types.

All 23 indicators from this source