← All actor clusters

85d316590edfb4212049c4490db08c4b

85d316590edfb4212049c4490db08c4b is a file hash that 3 published sources report in connection with Lazarus Group and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Bae Systems and Kaspersky. The earliest of those reports is dated 2017-02-12 and the most recent 2017-04-05.

file hash Lazarus GroupAPT38 MATCHED IN SOURCE

Listed as 85d316590edf...

First seen 2017-02-12 · last seen 2017-04-05

Sources

• …on the KNF website – but we have no reason to doubt this either. MD5 hash Filename File Info First seen Origin 85d316590edfb4212049c4490db08c4b gpsvc.exe Win32 (736 KB) 2017-01-26 07:46:24 PL The file is packed with a commercial packer known as 'Enigma…

  LAZARUS & WATERING-HOLE ATTACKS — Bae Systems · under “LAZARUS MALWARE” · published 2017-02-12 · pulled 2026-09-12

• …Backdoor Management Tool Filename: gpsvc.exe MD5: 85d316590edfb4212049c4490db08c4b SHA1: 4f0d7a33d23d53c0eb8b34d102cdd660fc5323a2 File Size: 753664 bytes File Type: PE32 executable (console) Intel 80386, for MS…

  Lazarus Under The Hood — Kaspersky · published 2017-04-05 · pulled 2026-09-12

• …on the KNF website – but we have no reason to doubt this either. MD5 hash Filename File Info First seen Origin 85d316590edfb4212049c4490db08c4b gpsvc.exe Win32 (736 KB) 2017-01-26 07:46:24 PL The file is packed with a commercial packer known as 'Enigma…

  LAZARUS & WATERING-HOLE ATTACKS — Bae Systems · under “LAZARUS MALWARE” · published 2017-02-12 · pulled 2026-09-27

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: LAZARUS & WATERING-HOLE ATTACKS

Bae Systems lists 11 other indicators in this source. 5 are shown, chosen across types.

• 911de8d67af652a87415f8c0a30688b2 file hash
• c1364bbf63b3617b25b58209e4529d8c file hash
• cb52c013f7af0219d45953bae663c9a2 file hash
• 125.214.195.17 IP address
• 196.29.166.218 IP address

All 12 indicators from this source

Cited by the same report: Lazarus Under The Hood

Kaspersky lists 46 other indicators in this source. 4 are shown, chosen across types.

• 964ba2c98b42e76f087789ab5f64e75dd370841a file hash
• a107f1046f5224fdb3a5826fa6f940a981fe65a1 file hash
• 46.100.250.10 IP address
• 53.250.8.254 IP address

All 47 indicators from this source

Cited by the same report: LAZARUS & WATERING-HOLE ATTACKS

Bae Systems lists 11 other indicators in this source. 3 are shown, chosen across types.

• 1507e7a741367745425e0530e23768e6 file hash
• 1bfbc0c9e0d9ceb5c3f4f6ced6bcfeae file hash
• 1f7897b041a812f96f1925138ea38c46 file hash

All 12 indicators from this source