`5365597ecc3fc59f09d500c91c06937eb3952a1d`

5365597ecc3fc59f09d500c91c06937eb3952a1d is a file hash that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Objective-See. The report is dated 2025-01-01.

file hash Contagious Interview MATCHED IN SOURCE

Listed as 5365597ecc3f...

First seen 2025-01-01 · last seen 2025-01-01

Source

…"-n" ], } ... } …interestingly it executes .test with the arguments /usr/local/bin/ssh and -n . The .test binary (SHA-1: 5365597ECC3FC59F09D500C91C06937EB3952A1D ) appears to be known malware : .test on VirusTotal Specifically it seems to be a macOS built of Khepri , which according to a…
The Mac Malware of 2024 👾 — Objective-See · under “👾 Zuru(2?)” · published 2025-01-01 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: The Mac Malware of 2024 👾

Objective-See lists 5 other indicators in this source.