`2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb`

2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb is a file hash that one published source reports in connection with APT38 activity, which public reporting attributes to North Korea (DPRK). It is cited here from Microsoft. The report is dated 2022-12-06.

file hash APT38 MATCHED IN SOURCE

Listed as 2e8d2525a523...

First seen 2022-12-06 · last seen 2022-12-06

Source

…loads and decodes the final implant into the memory with the GUID name which is used to remote access the infected machine. SHA256 2e8d2525a523b0a47a22a1e9cc9219d6526840d8b819d40d24046b17db8ea3fb Imphash 52ff8adb6e941e2ce41fd038063c5e0e Rich PE Hash ff102ff1ac1c891d1f5be7294035d19e Filetype PE32+ DLL Compile Timestamp…
DEV-0139 launches targeted attacks against the cryptocurrency industry | Microsoft Security Blog — Microsoft · under “Wsock32.dll” · published 2022-12-06 · pulled 2026-09-11

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: DEV-0139 launches targeted attacks against the cryptocurrency industry | Microsoft Security Blog

Microsoft lists 5 other indicators in this source.