`970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628`

970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628 is a file hash that one published source reports in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Google Threat Intelligence Group. The report is dated 2025-10-16.

file hash EtherHiding / UNC5342Contagious Interview CURATED

Listed as 970307708071...

First seen 2025-10-16 · last seen 2025-10-16

Sources

As printed:

970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628

Notes:

SHA-256 of the ZIP archive that delivers the initial JADESNOW downloader in UNC5342's Contagious Interview lure, listed in GTIG's indicator table. The archive is the artifact a victim is talked into extracting and running as a coding assessment; the EtherHiding retrieval happens only once the downloader inside it executes.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-08-30
…Indicators of Compromise Type Indicator Context SHA256 Hash (ZIP Archive) 970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628 ZIP archive containing the initial downloader, in this case JADESNOW.…
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains | Google Cloud Blog — Google Threat Intelligence Group · under “Indicators of Compromise” · published 2025-10-16 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 12 are shown, chosen across types.

All 17 indicators from this source