`252d1b7a379f97fddd691880c1cf93eaeb2a5e5572e92a25240b75953c88736c`

252d1b7a379f97fddd691880c1cf93eaeb2a5e5572e92a25240b75953c88736c is a file hash that one published source reports in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Threatconnect. The report is dated 2020-09-28.

file hash Kimsuky MATCHED IN SOURCE

Listed as 252d1b7a379f...

First seen 2020-09-28 · last seen 2020-09-28

Source

…Based upon their report we believe SHA256: 252d1b7a379f97fddd691880c1cf93eaeb2a5e5572e92a25240b75953c88736c , either is or is strikingly similar to the document discussed in their blog post based on these similarities: Lure document text…
Kimsuky Phishing Operations Putting In Work — Threatconnect · under “Kimsuky Nexus” · published 2020-09-28 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Kimsuky Phishing Operations Putting In Work

Threatconnect lists 1 other indicator in this source.