← All actor clusters

dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980

dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980 is a file hash that one published source reports in connection with APT38, Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Darkatlas. The report is dated 2025-06-23.

file hash APT38KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

Listed as dbe48dc08216...

First seen 2025-06-23 · last seen 2025-06-23

Source

• …with a known Command and Control (C2) server at IP address 104.168.136.24 . The malware sample : localfile~.x64 (SHA-256: dbe48dc08216850e93082b4d27868a7ca51656d9e55366f2642fc5106e3af980 ) has been identified as part of the Cosmic Rust malware family, which is attributed to APT38 (Bluenoroff) —a financially motivated…

  Bluenoroff (APT38) Live Infrastructure Hunting — Darkatlas · under “Initial Pivot” · published 2025-06-23 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Bluenoroff (APT38) Live Infrastructure Hunting

Darkatlas lists 8 other indicators in this source.

• 104.168.136.24 IP address
• 104.168.151.116 IP address
• 140.82.20.246 IP address
• 156.154.132.200 IP address
• 192.119.116.231 IP address
• 192.64.119.169 IP address
• 198.54.117.242 IP address
• 198.57.247.218 IP address