`fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf`

fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf is a file hash that 4 published sources report in connection with Contagious Interview, Kimsuky and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from N3mes1s, Threat Book, Microsoft and IGLOO Security. The earliest of those reports is dated 2026-03-31 and the most recent 2026-10-18.

file hash Contagious Interview Kimsuky APT38 MATCHED IN SOURCE

Listed as fcb81618bb15...

First seen 2026-03-31 · last seen 2026-10-18

Sources

…Linux RAT — ld.py (FULL SOURCE RECOVERED) Hash: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf Size: 12,323 bytes | Detection: 0/76 | Language: Python 3 1.1 Architecture The Linux RAT is a single-file Python script with no…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s · under “1. Linux RAT — ld.py (FULL SOURCE RECOVERED)” · published 2026-03-31 · pulled 2026-09-12
…C2 sfrclak.com http://sfrclak.com:8000/6202033 142.11.206.73 Hash Platform SHA256 Linux ( ld.py ) fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf Windows ( 6202033.ps1 ) 617b67a8e1210e4fc87c92d1d1da45a2f311c08d26e89b12307cf583c900d101 Windows persistence ( system.bat )…
Lazarus Group Poisons Axios: Inside the npm Supply Chain Attack — Threat Book · under “Previously Disclosed IOCs” · published 2026-03-31 · pulled 2026-09-12
…macOS binary SHA-256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a /tmp/ld.py Linux loader SHA-256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf packages.npm.org/product1 npm identifier (Windows) Sent as POST body to C2 packages.npm.org/product0 npm identifier (macOS) Sent as…
Mitigating the Axios npm supply chain compromise — Microsoft · under “Indicators of compromise” · published 2026-04-01 · pulled 2026-09-12
…SHA256 e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 SILKBELL (setup.js) 5 SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf WAVESHAPER.V2 (Linux) 6 SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a…
Supply Chain Attack on Axios NPM Package via North Korean Threat Actors — IGLOO Security · under “05. IoC, Indicator of Compromise” · published 2026-04-17 · pulled 2026-09-12
…Linux Payload Analysis — Python RAT Attribute VT-Verified Value SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf SHA1 59faac136680104948e083b3b67a70af9bfa5d5e MD5 9663665850cdd8fe12e30a671e5c4e6f Size 12,323 bytes Type Python…
Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s · under “5. Linux Payload Analysis — Python RAT” · published 2026-03-31 · pulled 2026-10-18

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution

N3mes1s lists 47 other indicators in this source. 5 are shown, chosen across types.

All 48 indicators from this source

Cited by the same report: Lazarus Group Poisons Axios: Inside the npm Supply Chain Attack

Threat Book lists 8 other indicators in this source. 4 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: Mitigating the Axios npm supply chain compromise

Microsoft lists 4 other indicators in this source. 3 are shown, chosen across types.

All 5 indicators from this source