`973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c`

973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c is a file hash that 3 published sources report in connection with Lazarus Group, APT38, Andariel and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Unit 42 and Picus Security. The earliest of those reports is dated 2024-09-09 and the most recent 2024-12-27.

file hash Lazarus Group APT38 Andariel Kimsuky MATCHED IN SOURCE

Listed as 973f7939ea03...

First seen 2024-09-09 · last seen 2024-12-27

Sources

…between PondRAT and Kupayupdate_stage2 In their recently published research, VIPYR Security analyzed the code of a Linux RAT (SHA256: 973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c ) that was an unknown at the time, which we now identify as the Linux variant of PondRAT.…
Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors — Unit 42 · under “Code Similarities between PondRAT and Kupayupdate_stage2” · published 2024-09-18 · pulled 2026-09-12
…rgedist.com/sfxl.php Domains: airbseeker.com globalkeystroke.com globalkeystroke.com PondRAT SHA256 hashes: 973f7939ea03fd2c9663dafc21bb968f56ed1b9a56b0284acf73c3ee141c053c 0b5db31e47b0dccfdec46e74c0e70c6a1684768dbacc9eacbb4fd2ef851994c7 3c8dbfcbb4fccbaf924f9a650a04cb4715f4a58d51ef49cc75bfcef0ac258a3e…
Threat Assessment: North Korean Threat Groups — Unit 42 · under “PondRAT” · published 2024-09-09 · pulled 2026-09-12
…91EAF215BE336EAE983D069DE16630CC3580E222C427F785E0DA312D0692D0FD 927B3564C1CF884D2A05E1D7BD24362CE8563A1E9B85BE776190AB7F8AF192F6 973F7939EA03FD2C9663DAFC21BB968F56ED1B9A56B0284ACF73C3EE141C053C 99DBC6FE3C3E465052FCEFA1642861747DC9E069EEB244589B605BD710B1E0D1 A03D13C9825E150810E6E6AAF053D71EC5A53B86581414DD982A74D4A8BC5475…
Exposing the Steps of the Kimsuky APT Group — Picus Security · under “SHA256 Hashes” · published 2024-12-27 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Gleaming Pisces Poisoned Python Packages Campaign Delivers PondRAT Linux and macOS Backdoors

Unit 42 lists 5 other indicators in this source.

Cited by the same report: Threat Assessment: North Korean Threat Groups

Unit 42 lists 41 other indicators in this source. 4 are shown, chosen across types.

All 42 indicators from this source

Cited by the same report: Exposing the Steps of the Kimsuky APT Group

Picus Security lists 26 other indicators in this source. 3 are shown, chosen across types.

All 27 indicators from this source