Chollima Hunter

← Remote Workers

92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a

92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a is a file hash that 4 published sources report in connection with Contagious Interview, Kimsuky and APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from N3mes1s, Threat Book, Microsoft and IGLOO Security. The earliest of those reports is dated 2026-03-31 and the most recent 2026-10-18.

file hash Contagious InterviewKimsukyAPT38 MATCHED IN SOURCE

Listed as 92ff08773995...

First seen 2026-03-31 · last seen 2026-10-18

Sources

  • …macOS Payload Analysis — NukeSped RAT Attribute VT-Verified Value SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a SHA1 13ab317c5dcab9af2d1bdb22118b9f09f8a4038e MD5 7a9ddef00f69477b96252ca234fcbeeb Size 657,424 bytes (642 KB) Type…
    Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution — N3mes1s · under “4. macOS Payload Analysis — NukeSped RAT” · published 2026-03-31 · pulled 2026-09-12
  • …Windows persistence ( system.bat ) f7d335205b8d7b20208fb3ef93ee6dc817905dc3ae0c10a0b164f4e7d07121cd macOS ( com.apple.act.mond ) 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a New IOCs C2 callnrwise.com 142.11.196.73 142.11.199.73 Hash…
    Lazarus Group Poisons Axios: Inside the npm Supply Chain Attack — Threat Book · under “Previously Disclosed IOCs” · published 2026-03-31 · pulled 2026-09-12
  • …Windows LOLBin Windows Terminal copy, used as PowerShell proxy /Library/Caches/com.apple.act.mond macOS binary SHA-256: 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a /tmp/ld.py Linux loader SHA-256: fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf packages.npm.org/product1 npm…
    Mitigating the Axios npm supply chain compromise — Microsoft · under “Indicators of compromise” · published 2026-04-01 · pulled 2026-09-12
  • …SHA256 fcb81618bb15edfdedfb638b4c08a2af9cac9ecfa551af135a8402bf980375cf WAVESHAPER.V2 (Linux) 6 SHA256 92ff08773995ebc8d55ec4b8e1a225d0d1e51efa4ef88b8849d0071230c9645a WAVESHAPER.V2 (macOS) 7 SHA256 5bb67e88846096f1f8d42a0f0350c9c46260591567612ff9af46f98d1b7571cd…
    Supply Chain Attack on Axios NPM Package via North Korean Threat Actors — IGLOO Security · under “05. IoC, Indicator of Compromise” · published 2026-04-17 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Axios npm Supply Chain Compromise (2026-03-31) — Full RE + Dynamic Analysis + BlueNoroff Attribution

N3mes1s lists 47 other indicators in this source. 5 are shown, chosen across types.

All 48 indicators from this source

Cited by the same report: Lazarus Group Poisons Axios: Inside the npm Supply Chain Attack

Threat Book lists 8 other indicators in this source. 4 are shown, chosen across types.

All 9 indicators from this source

Cited by the same report: Mitigating the Axios npm supply chain compromise

Microsoft lists 4 other indicators in this source. 3 are shown, chosen across types.

All 5 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.