`fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7`

fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 is a file hash that 3 published sources report in connection with Lazarus Group, unclustered DPRK, APT38, Andariel and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, Symantec and Unit 42. The earliest of those reports is dated 2023-03-31 and the most recent 2024-09-09.

file hash Lazarus GroupDPRK (cluster unattributed)APT38 Andariel Kimsuky MATCHED IN SOURCE

Listed as fee4f9dabc09...

First seen 2023-03-31 · last seen 2024-09-09

Sources

…2fdf61fdfd649f8bbf5730307a0ab5d1 b2a89eebb5be61939f5458a024c929b169b4dc85 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 bb915073385dd16a846dfa318afa3c19 6285ffb5f98d35cd98e78d48b63a05af6e4e4dea…
36gate: supply chain attack | Group-IB Blog — Group-IB · under “Indicators of compromise” · published 2023-03-31 · pulled 2026-09-11
…There are at least two variants of this file (SHA256: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 and fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7) and they seem to relate to different versions of the software. The malicious code is in the InitFunc_0 function of libffmpeg.dylib,…
3CX: Supply Chain Attack Affects Thousands of Users Worldwide | SECURITY.COM — Symantec · under “Mac versions” · published 2023-03-31 · pulled 2026-09-11
…87c5d0c93b80acf61d24e7aaf0faae231ab507ca45483ad3d441b5d1acebc43c 99dbc6fe3c3e465052fcefa1642861747dc9e069eeb244589b605bd710b1e0d1 fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 7667d1b8fcc4f712084e3e3f8b4ab505ab150c52aea7b219249ec508b4b0e224 UpdateAgent SHA256 hash:…
Threat Assessment: North Korean Threat Groups — Unit 42 · under “libffmpeg.dy” · published 2024-09-09 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: 36gate: supply chain attack | Group-IB Blog

Group-IB lists 46 other indicators in this source. 5 are shown, chosen across types.

All 47 indicators from this source

Cited by the same report: 3CX: Supply Chain Attack Affects Thousands of Users Worldwide | SECURITY.COM

Symantec lists 2 other indicators in this source.

Cited by the same report: Threat Assessment: North Korean Threat Groups

Unit 42 lists 41 other indicators in this source. 5 are shown, chosen across types.

All 42 indicators from this source