← All actor clusters

172.96.137.224

172.96.137.224 is an IP address that 3 published sources report in connection with Andariel activity, which public reporting attributes to North Korea (DPRK). It is cited here from Unit 42, Rewterz and Symantec. The earliest of those reports is dated 2024-10-30 and the most recent 2026-10-18.

ip address Andariel MATCHED IN SOURCE

First seen 2024-10-30 · last seen 2026-10-18

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• …This customized version beacons to the IP address 172.96.137.224 .…

  Jumpy Pisces Engages in Play Ransomware — Unit 42 · under “Threat Actor Tooling” · published 2024-10-30 · pulled 2026-09-12

• …Loss Unauthorized Access Credential Theft Privilege Escalation Indicators of Compromise Domain Name americajobmail.site IP 172.96.137.224 MD5 e12f93d462a622f32a4ff1e646549c42 f01eae4ee3cc03d621be7b0af7d60411 SHA-256…

  Play Ransomware and North Korean APT45 Work Together to Launch Major Cyberattack – Active IOCs - Rewterz — Rewterz · under “IP” · published 2024-10-31 · pulled 2026-09-12

• …Command-and-control server 51.81.168.157:443 Command-and-control server 217.195.153.209 IP address used by Plink 172.96.137.224 IP address used by Plink 144.208.127.115 IP address used by Plink Certificate 1 thumbprint =…

  Stonefly: Extortion Attacks Continue Against U.S. Targets — Symantec · under “Protection/Mitigation” · published 2024-10-02 · pulled 2026-09-12

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Jumpy Pisces Engages in Play Ransomware

Unit 42 lists 9 other indicators in this source. 5 are shown, chosen across types.

• 243ad5458706e5c836f8eb88a9f67e136f1fa76ed44868217dc995a8c7d07bf7 file hash
• 2b254ae6690c9e37fa7d249e8578ee27393e47db1913816b4982867584be713a file hash
• 6624c7b8faac176d1c1cb10b03e7ee58a4853f91 file hash
• 6e95d94d5d8ed2275559256c5fb5fc6d01da6b46 file hash
• 879fa942f9f097b74fd6f7dabcf1745a file hash

All 10 indicators from this source

Cited by the same report: Play Ransomware and North Korean APT45 Work Together to Launch Major Cyberattack – Active IOCs - Rewterz

Rewterz lists 6 other indicators in this source. 4 are shown, chosen across types.

• 540853beffb0ba9b26cf305bcf92fad82599eb3c file hash
• b1ac26dac205973cd1288a38265835eda9b9ff2edc6bd7c6cb9dee4891c9b449 file hash
• e12f93d462a622f32a4ff1e646549c42 file hash
• e3069713add2d99750af6c30580fb3595a0b6abc file hash

All 7 indicators from this source

Cited by the same report: Stonefly: Extortion Attacks Continue Against U.S. Targets

Symantec lists 5 other indicators in this source. 3 are shown, chosen across types.

• 485465f38582377f9496a6c77262670a313d8c6e01fd29a5dbd919b9a40e68d5 file hash
• 216.120.201.112 IP address
• 217.195.153.209 IP address

All 6 indicators from this source