3b50dd96d8d058d583bc651a7a1c33cae5c020b04b683f05b46cca09ed66e6fb
3b50dd96d8d058d583bc651a7a1c33cae5c020b04b683f05b46cca09ed66e6fb is a file hash
that one published source reports
in connection with Konni activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Frost (@fr0s7_).
The report is dated 2026-09-29.
file hash Konni RESEARCHER POST
Source
-
A self-thread the researcher tags #DPRK #KONNI, describing an invitation to a fake Sanctum and Superteam Korea event during Korea Blockchain Week in Seoul. The LNK runs conhost and PowerShell, carves a decoy PDF and an XOR-encoded payload out of itself, writes the payload to a .err file under C:\ProgramData\Diagnosis and registers a scheduled task that runs a PowerShell backdoor every 30 minutes, falling back to SYSTEM. The backdoor talks to a PHP endpoint on an InfinityFree subdomain and exits if any of 53 analysis tools is running. The four hashes are, in order, the ZIP, the .err payload, the PowerShell script and the decoy PDF, as the thread labels them; the decoy is the lure document itself, not malicious code.
x.com/fr0s7_/status/2104911509629304848 — Frost (@fr0s7_)
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.