15dc6a28b875b4706bcc0db4a026aeb0
15dc6a28b875b4706bcc0db4a026aeb0 is a file hash
that 2 published sources report
in connection with Kimsuky and APT38 activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from IGLOO Security and Dion Alexander.
The earliest of those reports is dated 2025-04-13 and the most recent 2026-10-26.
file hash KimsukyAPT38 MATCHED IN SOURCE
Listed as 15dc6a28b875...
Sources
-
…38243.tmp 19 MD5 245d729238809b580179b70b7347cf65 nD9327.tmp 20 MD5 15dc6a28b875b4706bcc0db4a026aeb0 (PebbleDash) 21 MD5 7349683077ce4fcac77580848182ead9 (PebbleDash) 22 MD5…
[IG-25-4009-O] 북한 Kimsuky그룹의 스피어피싱을 통한 악성 LNK파일 : Powershell 백도어 설치 및 RCE 공격 절차 분석 : Malicious LNK through spear phishing by North Korea's Kimsuky Group: Analysis of Powershell backdoor installation and RCE attack procedures — IGLOO Security -
…of Compromise (IOCs) Malicious File Hashes: SHA256: 875B0CBAD25E04A255B13F86BA361B58453B6F3C5CC11ACA2DB573C656E64E24 MD5: 15DC6A28B875B4706BCC0DB4A026AEB0 Suspicious Network Indicators: IP Address: 211.239.117.117 → Potential C2 Server Domain: www.addfriend.kr → Suspicious, used for…
Unpacking APT38: Static and Dynamic Analysis of Lazarus Group Malware — Dion Alexander
Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.
Related indicators
Cited by the same report: [IG-25-4009-O] 북한 Kimsuky그룹의 스피어피싱을 통한 악성 LNK파일 : Powershell 백도어 설치 및 RCE 공격 절차 분석 : Malicious LNK through spear phishing by North Korea's Kimsuky Group: Analysis of Powershell backdoor installation and RCE attack procedures
All 25 indicators from this source