`73d2899aade924476e58addf26254c2e`

73d2899aade924476e58addf26254c2e is a file hash that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from AhnLab ASEC. The earliest of those reports is dated 2025-05-21 and the most recent 2025-05-22.

file hash Kimsuky MATCHED IN SOURCE

Listed as 73d2899aade9...

First seen 2025-05-21 · last seen 2025-05-22

Sources

…서명된 인증서는 다른 파일 서명에 사용되지 않고 악성코드 2개 파일 서명에만 사용되어 실제 Nexaweb 사의 인증서인지 문의했지만 아직 답변을 못 받았다. MD5 27d4ff7439694041ef86233c2b804e1f 73d2899aade924476e58addf26254c2e aa8936431f7bc0fabb0b9efb6ea153f9 Tags: certificate CertificateLeak desktop.ini HTTPSpy 인증서 인증서유출 인증서서명악성코드 JobDescription…
Larva-25004 (Kimsuky 연관) 그룹의 추가 인증서 악용 사례 - Nexaweb 인증서로 서명된 악성코드 - ASEC — AhnLab ASEC · under “의문의 Nexaweb 인증서” · published 2025-05-22 · pulled 2026-09-12
…Certificate Two files were discovered, and their MD5 hash values are as follows: Job Description (LM HR Division II).pdf.scr : 73d2899aade924476e58addf26254c2e Known as Automation Manager JD(LM HR II).scr: aa8936431f7bc0fabb0b9efb6ea153f9 These files were signed with the Nexaweb certificate…
Case of Larva-25004 Group (Related to Kimsuky) Exploiting Additional Certificate - Malware Signed with Nexaweb Certificate - ASEC — AhnLab ASEC · under “Malware Signed with the Nexaweb Certificate” · published 2025-05-21 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Larva-25004 (Kimsuky 연관) 그룹의 추가 인증서 악용 사례 - Nexaweb 인증서로 서명된 악성코드 - ASEC

AhnLab ASEC lists 2 other indicators in this source.