`f17502d3e12615b0fa8868472a4eabfb`

f17502d3e12615b0fa8868472a4eabfb is a file hash that 2 published sources report in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kaspersky Securelist and 0xthreatintel. The earliest of those reports is dated 2021-11-29 and the most recent 2021-12-03.

file hash APT37 MATCHED IN SOURCE

Listed as f17502d3e126...

First seen 2021-11-29 · last seen 2021-12-03

Sources

…At that time, lures related to COVID-19 and credential access were used. HWP hash HWP file name Dropped payload hash f17502d3e12615b0fa8868472a4eabfb 코로나19 재감염 사례-백신 무용지물.hwp (Covid-19 reinfection case-Useless vaccine.hwp) 72e5b8ea33aeb083631d1e8b302e76af (Visual Basic Script)…
ScarCruft surveilling North Korean defectors and human rights activists | Securelist — Kaspersky Securelist · under “Older malicious HWP documents” · published 2021-11-29 · pulled 2026-09-12
…Steganography T1566 .001 : Phishing: Spearphishing Attachment. IOCs: Document 1 .hwp file :- 코로나19 재감염 사례-백신 무용지물.hwp hashes: MD5 f17502d3e12615b0fa8868472a4eabfb SHA1 40359e0e92a99b428778ac4e9d70fbc4d5307961 SHA256 dbbecbafd905f0b4a2c8194cba3c879d2b933094be9bf27ae69295b4d1de2055 DNS…
APT37 targets Journalists & Security Researchers — 0xthreatintel · under “IOCs:” · published 2021-12-03 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: ScarCruft surveilling North Korean defectors and human rights activists | Securelist

Kaspersky Securelist lists 6 other indicators in this source.

Cited by the same report: APT37 targets Journalists & Security Researchers

0xthreatintel lists 17 other indicators in this source. 6 are shown, chosen across types.

All 18 indicators from this source