Chollima Hunter

← All actor clusters

24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a

24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a is a file hash that 2 published sources report in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Foxit and 3CX. The earliest of those reports is dated 2023-04-20 and the most recent 2025-09-01.

file hash Lazarus Group MATCHED IN SOURCE

Listed as 24d5dd3006c6...

First seen 2023-04-20 · last seen 2025-09-01

Sources

  • …Themida-packed Quasar Table 6: Indicators of Compromise linked to actor, without hashes digest.sha256 Comment 24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a Fast Reverse Proxy v0.32.1, also observed by Mandiant in the 3CX supply chain attack…
    Three Lazarus RATs coming for your cheese — Foxit · under “Indicators of Compromise” · published 2025-09-01 · pulled 2026-09-12
  • …00a43d64f9b5187a1e1f922b99b09b77 Code signing certificate serial # 9599605970805149948 MsMpEng.exe SHA256: 24d5dd3006c63d0f46fb33cbc1f576325d4e7e03e3201ff4a3c1ffa604f1b74a SHA1: d7ba13662fbfb254acaad7ae10ad51e0bd631933 MD5: 19dbffec4e359a198daf4ffca1ab9165 Command and Control Mandiant identified that…
    Mandiant Security Update – Initial Intrusion Vector — 3CX · under “Indicators of Compromise” · published 2023-04-20 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Three Lazarus RATs coming for your cheese

Foxit lists 4 other indicators in this source.

Cited by the same report: Mandiant Security Update – Initial Intrusion Vector

3CX lists 7 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.