6f574714403c37dd55531a25105c964a6522af7e58f2154f22905667d81eae10
6f574714403c37dd55531a25105c964a6522af7e58f2154f22905667d81eae10 is a file hash
that one published source reports
in connection with Konni activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Frost (@fr0s7_).
The report is dated 2026-09-29.
file hash Konni RESEARCHER POST
Source
-
A self-thread the researcher tags #DPRK #KONNI, describing an invitation to a fake Sanctum and Superteam Korea event during Korea Blockchain Week in Seoul. The LNK runs conhost and PowerShell, carves a decoy PDF and an XOR-encoded payload out of itself, writes the payload to a .err file under C:\ProgramData\Diagnosis and registers a scheduled task that runs a PowerShell backdoor every 30 minutes, falling back to SYSTEM. The backdoor talks to a PHP endpoint on an InfinityFree subdomain and exits if any of 53 analysis tools is running. The four hashes are, in order, the ZIP, the .err payload, the PowerShell script and the decoy PDF, as the thread labels them; the decoy is the lure document itself, not malicious code.
x.com/fr0s7_/status/2104911509629304848 — Frost (@fr0s7_)
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.