`27d4ff7439694041ef86233c2b804e1f`

27d4ff7439694041ef86233c2b804e1f is a file hash that 2 published sources report in connection with Kimsuky activity, which public reporting attributes to North Korea (DPRK). It is cited here from AhnLab ASEC. The earliest of those reports is dated 2025-05-21 and the most recent 2025-05-22.

file hash Kimsuky MATCHED IN SOURCE

Listed as 27d4ff743969...

First seen 2025-05-21 · last seen 2025-05-22

Sources

…)로 서명된 파일들에서는 악성코드가 발견되지 않았다. 악성코드에 서명된 인증서는 다른 파일 서명에 사용되지 않고 악성코드 2개 파일 서명에만 사용되어 실제 Nexaweb 사의 인증서인지 문의했지만 아직 답변을 못 받았다. MD5 27d4ff7439694041ef86233c2b804e1f 73d2899aade924476e58addf26254c2e aa8936431f7bc0fabb0b9efb6ea153f9 Tags: certificate CertificateLeak desktop.ini HTTPSpy 인증서…
Larva-25004 (Kimsuky 연관) 그룹의 추가 인증서 악용 사례 - Nexaweb 인증서로 서명된 악성코드 - ASEC — AhnLab ASEC · under “의문의 Nexaweb 인증서” · published 2025-05-22 · pulled 2026-09-12
…We have contacted Nexaweb to verify if the certificate is actually theirs, but we have not yet received a response. MD5 27d4ff7439694041ef86233c2b804e1f 73d2899aade924476e58addf26254c2e aa8936431f7bc0fabb0b9efb6ea153f9 Tags: certificate CertificateLeak desktop.ini HTTPSpy 인증서…
Case of Larva-25004 Group (Related to Kimsuky) Exploiting Additional Certificate - Malware Signed with Nexaweb Certificate - ASEC — AhnLab ASEC · under “Nexaweb Certificate Still Unknown” · published 2025-05-21 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Larva-25004 (Kimsuky 연관) 그룹의 추가 인증서 악용 사례 - Nexaweb 인증서로 서명된 악성코드 - ASEC

AhnLab ASEC lists 2 other indicators in this source.