1eda2088df37dda72c95614dc0c6911e5425e78d093f847008e1003a3f3573d1
1eda2088df37dda72c95614dc0c6911e5425e78d093f847008e1003a3f3573d1 is a file hash
that one published source reports
in connection with Kimsuky activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Frost (@fr0s7_).
The report is dated 2026-10-01.
file hash Kimsuky RESEARCHER POST
Source
-
A self-thread the researcher tags #DPRK #Kimsuky #UAT-5394. A .docx.lnk and a macro-enabled .xls carve XOR-encoded stages from the LNK, run anti-VM and reconnaissance checks, register a scheduled task every 30 minutes, fetch a list (gho.txt) that allowlists victim IDs, and load a GZIP-compressed .NET payload whose first bytes the server masks as an RTF header. The payload is a fork of XenoRAT the researcher calls Stella. 31.59.138.144 serves the stages; 107.172.249.140 is the C2. The hash is the delivery ZIP.
x.com/fr0s7_/status/2105550113901068766 — Frost (@fr0s7_)
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.