47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f
47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f is a file hash
that 2 published sources report
in connection with Lazarus Group and APT38 activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Unit 42 and Elastic Security Labs.
The earliest of those reports is dated 2025-04-14 and the most recent 2025-05-06.
file hash Lazarus GroupAPT38 MATCHED IN SOURCE
Listed as 47e997b85ed3...
Sources
-
…format we observed in RN Stealer, which we discuss in the following sections. Stage SHA256 Hash YAML Deserialization Payload 47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f RN Loader 937c533bddb8bbcd908b62f2bf48e5bc11160505df20fea91d9600d999eafa79 RN Stealer…
Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware — Unit 42 -
…), this payload allows for arbitrary Python object deserialization, resulting in RCE. PyYAML Deserialization Payload (VT Hash: 47e997b85ed3f51d2b1d37a6a61ae72185d9ceaf519e2fdb53bf7e761b7bc08f ) We recreated this malicious setup by hosting the YAML deserialization payload on a Python+Flask web application, using PythonAnywhere to…
Bit ByBit - emulation of the DPRK's largest cryptocurrency heist — Elastic Security Labs
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.
Related indicators
Cited by the same report: Slow Pisces Targets Developers With Coding Challenges and Introduces New Customized Python Malware
All 28 indicators from this source