← All actor clusters

e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec

e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec is a file hash that 3 published sources report in connection with Lazarus Group, APT38, Andariel and Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from Group-IB, Volexity and Unit 42. The earliest of those reports is dated 2023-03-30 and the most recent 2024-09-09.

file hash Lazarus GroupAPT38AndarielKimsuky MATCHED IN SOURCE

Listed as e6bbc33815b9...

First seen 2023-03-30 · last seen 2024-09-09

Sources

• …d5101c3b86d973a848ab7ed79cd11e5a 3dc840d32ce86cebf657b17cef62814646ba8e98 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec 0eeb1c0133eb4d571178b2d9d14ce3e9 bfecb8ce89a312d2ef4afc64a63847ae11c6f69e…

  36gate: supply chain attack | Group-IB Blog — Group-IB · under “Indicators of compromise” · published 2023-03-31 · pulled 2026-09-11

• …File Type Macintosh Disk Image MD5 d5101c3b86d973a848ab7ed79cd11e5a SHA1 3dc840d32ce86cebf657b17cef62814646ba8e98 SHA256 e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec The backdoor component is libffmpeg.dylib located in /Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries .…

  3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity — Volexity · under “macOS ICONIC Analysis” · published 2023-03-30 · pulled 2026-09-11

• …hash: 927b3564c1cf884d2a05e1d7bd24362ce8563a1e9b85be776190ab7f8af192f6 SmoothOperator Malicious 3CX DMG SHA256 hash: e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec libffmpeg.dy SHA256 hashes: a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67…

  Threat Assessment: North Korean Threat Groups — Unit 42 · under “Malicious 3CX DMG” · published 2024-09-09 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: 36gate: supply chain attack | Group-IB Blog

Group-IB lists 46 other indicators in this source. 5 are shown, chosen across types.

• f3487a1324f4c11b35504751a5527bc60eb95382 file hash
• f3d4144860ca10ba60f7ef4d176cc736 file hash
• f79c3b0adb6ec7bcc8bc9ae955a1571aaed6755a28c8b17b1d7595ee86840952 file hash
• fad482ded2e25ce9e1dd3d3ecc3227af714bdfbbde04347dbc1b21d6a3670405 file hash
• fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 file hash

All 47 indicators from this source

Cited by the same report: 3CX Supply Chain Compromise Leads to ICONIC Incident | Volexity

Volexity lists 23 other indicators in this source. 4 are shown, chosen across types.

• philip.je@proton.me email address
• remey.simpson@outlook.com email address
• https://github.com/neo23x0 GitHub account
• https://github.com/sigmahq GitHub account

All 24 indicators from this source

Cited by the same report: Threat Assessment: North Korean Threat Groups

Unit 42 lists 41 other indicators in this source. 3 are shown, chosen across types.

• f1713afaf5958bdf3e975ebbab8245a98a84e03f8ce52175ef1568de208116e0 file hash
• 23.227.202.54 IP address
• 23.254.226.90 IP address

All 42 indicators from this source