`d288766fa268bc2534f85fd06a5d52264e646c47`

d288766fa268bc2534f85fd06a5d52264e646c47 is a file hash that 2 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from ESET and CISA. The earliest of those reports is dated 2019-09-09 and the most recent 2026-11-09.

file hash Lazarus Group MATCHED IN SOURCE

Listed as d288766fa268...

First seen 2019-09-09 · last seen 2026-11-09

Sources

…From September 2019 , CISA started to call newer versions of this malware BADCALL (SHA-1: D288766FA268BC2534F85FD06A5D52264E646C47 ). Figure 4.…
Linux malware strengthens links between Lazarus and the 3CX supply-chain attack — ESET · under “BADCALL for Linux” · published 2023-04-20 · pulled 2026-09-12
…Size 233472 bytes Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows MD5 c01dc42f65acaf1c917c0cc29ba63adc SHA1 d288766fa268bc2534f85fd06a5d52264e646c47 SHA256 4257bb11570ed15b8a15aa3fc051a580eab5d09c2f9d79e4b264b752c8e584fc SHA512…
North Korean Trojan: BADCALL — CISA · under “Details” · published 2019-09-09 · pulled 2026-10-01

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Linux malware strengthens links between Lazarus and the 3CX supply-chain attack

ESET lists 14 other indicators in this source. 7 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: North Korean Trojan: BADCALL

CISA lists 19 other indicators in this source. 5 are shown, chosen across types.

All 20 indicators from this source