805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094
805e6e6c170e6a35e062ea85d1a5f63b3b022359d27fa55537a54eb376db8094 is a file hash
that one published source reports
in connection with Konni activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Frost (@fr0s7_).
The report is dated 2026-09-29.
file hash Konni RESEARCHER POST
Source
-
A self-thread the researcher tags #DPRK #KONNI, describing an invitation to a fake Sanctum and Superteam Korea event during Korea Blockchain Week in Seoul. The LNK runs conhost and PowerShell, carves a decoy PDF and an XOR-encoded payload out of itself, writes the payload to a .err file under C:\ProgramData\Diagnosis and registers a scheduled task that runs a PowerShell backdoor every 30 minutes, falling back to SYSTEM. The backdoor talks to a PHP endpoint on an InfinityFree subdomain and exits if any of 53 analysis tools is running. The four hashes are, in order, the ZIP, the .err payload, the PowerShell script and the decoy PDF, as the thread labels them; the decoy is the lure document itself, not malicious code.
x.com/fr0s7_/status/2104911509629304848 — Frost (@fr0s7_)
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.