← All actor clusters

5f6682ad9da4590cba106e2f1a8cbe26

5f6682ad9da4590cba106e2f1a8cbe26 is a file hash that 3 published sources report in connection with APT37 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Plainbit, Genians and Rewterz. The earliest of those reports is dated 2024-04-03 and the most recent 2024-11-05.

file hash APT37 MATCHED IN SOURCE

Listed as 5f6682ad9da4...

First seen 2024-04-03 · last seen 2024-11-05

Sources

• …System (T1113) Screen Capture Command and Control (T1102.002) Web Service: Bidirectional Communication IoC MD5 5F6682AD9DA4590CBA106E2F1A8CBE26 : LNK 파일 A1640EB8F424EBE13B94955F8D0F6843 : working.bat 78480139D86520BA82766C5B3C9A7479 : temp.dat 31AEB43B981D4D6272193E321BB21333 :…

  Analysis of ROKRAT Malware inside LNK Malicious file from North Korea — Plainbit · under “IoC” · published 2024-04-03 · pulled 2026-09-11

• …침해 지표 (Indicator of Compromise) ● MD5 5f6682ad9da4590cba106e2f1a8cbe26 7a66738cca9f86f4133415eedcbf8e88 105ecd9f6585df4e1fe267c2809ee190 852544f01172b8bae14ec3e4d0b35115 358122718ba11b3e8bb56340dbe94f51 acf4085…

  APT37 위협 배후의 사이버 정찰 활동 분석 — Genians · under “7. 침해 지표 (Indicator of Compromise)” · published 2024-11-05 · pulled 2026-09-12

• …Information Theft and Espionage Indicators of Compromise IP 108.181.50.58 158.247.219.10 175.214.194.61 61.97.243.2 MD5 5f6682ad9da4590cba106e2f1a8cbe26 SHA-256 dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6 SHA1 7043c7c101532df47c832ce5270745dd3d1e8c08…

  APT37 aka ScarCruft or RedEyes - Active IOCs - Rewterz — Rewterz · under “MD5” · published 2024-11-04 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Analysis of ROKRAT Malware inside LNK Malicious file from North Korea

Plainbit lists 2 other indicators in this source.

• user3@daum.net email address
• a1640eb8f424ebe13b94955f8d0f6843 file hash

Cited by the same report: APT37 위협 배후의 사이버 정찰 활동 분석

Genians lists 17 other indicators in this source. 5 are shown, chosen across types.

• sandozmessi@gmail.com email address
• 105ecd9f6585df4e1fe267c2809ee190 file hash
• 7a66738cca9f86f4133415eedcbf8e88 file hash
• 108.181.52.229 IP address
• 108.181.52.231 IP address

All 18 indicators from this source

Cited by the same report: APT37 aka ScarCruft or RedEyes - Active IOCs - Rewterz

Rewterz lists 6 other indicators in this source. 5 are shown, chosen across types.

• 7043c7c101532df47c832ce5270745dd3d1e8c08 file hash
• dbd5d662cc53d4b91cf7da9979cdffd1b4f702323bb9ec4114371bc6f4f0d4a6 file hash
• 108.181.50.58 IP address
• 158.247.219.10 IP address
• 175.214.194.61 IP address

All 7 indicators from this source