`e11bb2478930d0b5f6c473464f2a2b6e`

e11bb2478930d0b5f6c473464f2a2b6e is a file hash that 3 published sources report in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from S2W, IGLOO Security and SOCRadar. The earliest of those reports is dated 2024-02-16 and the most recent 2026-10-26.

file hash APT37 MATCHED IN SOURCE

Listed as e11bb2478930...

First seen 2024-02-16 · last seen 2026-10-26

Sources

…in an in-the-wild attack against specific organizations in South Korea. (Related sample) 12721952796–107–0_1.ad_toast.html (MD5: e11bb2478930d0b5f6c473464f2a2b6e ) (Distribution method) Malicious script downloaded from attacker’s C&C server* via freeware’s ad add-on feature process (*Uses a domain…
Unmasking CVE-2024-38178: The Silent Threat of Windows Scripting Engine — S2W · under “Executive Summary” · published 2024-10-16 · pulled 2026-09-12
…NO File Name MD5 Notes 1 ad_toast.html e11bb2478930d0b5f6c473464f2a2B6e 2 43 b9d4702c1b72659f486259520f48b483 1st Malware (/images/20230912/43 xor(0x4B) Encoding Shellcode)…
Analyzing the North Korean hacking group APT37 (Scarcruft) attack with CVE-2024-38178 : Operation Code On Toast — IGLOO Security · under “6.1. Files” · published 2024-10-23 · pulled 2026-10-01
…utilizing a compromised advertisement server to distribute malicious code. Indicators of Compromise Related to RokRAT MD5: e11bb2478930d0b5f6c473464f2a2b6e bd2d599ab51f9068d8c8eccadaca103d SHA-256:…
Threat Actor Profile: ScarCruft / APT37 - SOCRadar® Cyber Intelligence Inc. — SOCRadar · under “Indicators of Compromise Related to RokRAT” · published 2024-02-16 · pulled 2026-10-02

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Analyzing the North Korean hacking group APT37 (Scarcruft) attack with CVE-2024-38178 : Operation Code On Toast

IGLOO Security lists 2 other indicators in this source.

Cited by the same report: Threat Actor Profile: ScarCruft / APT37 - SOCRadar® Cyber Intelligence Inc.

SOCRadar lists 4 other indicators in this source.