`f5b338d6bca36d47ee04d93d08c57861`

f5b338d6bca36d47ee04d93d08c57861 is a file hash that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Threat Book. The report is dated 2020-12-18.

file hash Lazarus Group MATCHED IN SOURCE

Listed as f5b338d6bca3...

First seen 2020-12-18 · last seen 2020-12-18

Source

…online information of the Trojan, call the function UpdateAuthCode to save the host information submitted by the Trojan to the file /tmp/f5b338d6bca36d47ee04d93d08c57861（the md5 value of sess）.log. After the attacker issues the command, call the SaveCommand function to save the command data to the file…
Thief in the Dark: Lazarus Uses Dtrack RAT Tool to Steal Massive Medical Data — Threat Book · under “3.2.1Dtrack php Server” · published 2020-12-18 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Thief in the Dark: Lazarus Uses Dtrack RAT Tool to Steal Massive Medical Data

Threat Book lists 5 other indicators in this source.