d782bdd883c0a1f8c484e50765a1481116f9e700fea7dc9e39df2ab4cb9dd8a2
d782bdd883c0a1f8c484e50765a1481116f9e700fea7dc9e39df2ab4cb9dd8a2 is a file hash
that one published source reports
in connection with Konni activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Frost (@fr0s7_).
The report is dated 2026-09-29.
file hash Konni RESEARCHER POST
Source
-
A self-thread the researcher tags #DPRK #KONNI, describing an invitation to a fake Sanctum and Superteam Korea event during Korea Blockchain Week in Seoul. The LNK runs conhost and PowerShell, carves a decoy PDF and an XOR-encoded payload out of itself, writes the payload to a .err file under C:\ProgramData\Diagnosis and registers a scheduled task that runs a PowerShell backdoor every 30 minutes, falling back to SYSTEM. The backdoor talks to a PHP endpoint on an InfinityFree subdomain and exits if any of 53 analysis tools is running. The four hashes are, in order, the ZIP, the .err payload, the PowerShell script and the decoy PDF, as the thread labels them; the decoy is the lure document itself, not malicious code.
x.com/fr0s7_/status/2104911509629304848 — Frost (@fr0s7_)
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.