27dd9a146de5f8e7978a00c53ca8ec603f88e7652f99d1493b274689a4c8e542
27dd9a146de5f8e7978a00c53ca8ec603f88e7652f99d1493b274689a4c8e542 is a file hash
that one published source reports
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Ransom-ISAC.
The report is dated 2025-12-08.
file hash EtherHiding / UNC5342Contagious Interview CURATED
Source
-
DEV#POPPER.JS RAT VARIATIONS 011025_0xc3d4740f747e2f0adf622d2ac48ef6bda4b18e3d152028f0f8027216199c4fee_FINAL.txt 27dd9a146de5f8e7978a00c53ca8ec603f88e7652f99d1493b274689a4c8e542
SHA-256 of a deobfuscated DEV#POPPER.JS RAT variant that Ransom-ISAC recovered from BSC transaction 0xc3d4740f747e2f0adf622d2ac48ef6bda4b18e3d152028f0f8027216199c4fee (file 011025_0xc3d4740f747e2f0adf622d2ac48ef6bda4b18e3d152028f0f8027216199c4fee_FINAL.txt). Ransom-ISAC prints 20 of more than 70 such hashes in the post and puts the rest in its GitHub repository for part 4, which this site has not mirrored. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.