← All actor clusters

165.154.230.24

165.154.230.24 is an IP address that 3 published sources report in connection with Kimsuky and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Genians and AhnLab ASEC. The earliest of those reports is dated 2023-11-08 and the most recent 2024-04-17.

ip address KimsukyDPRK (cluster unattributed) MATCHED IN SOURCE

First seen 2023-11-08 · last seen 2024-04-17

Network

Looked up 2026-09-21 at ip-api.com. A hosting range is not evidence on its own.

Sources

• ….com kyungdaek.com siloamclinic.com dddon.kr iso3488.co.kr regard.co.kr aymdtt.co.kr gbionet.com strehab.com well-story.co.kr vwellpain.com 165.154.230.24 122.155.191.33 218.150.78.197 183.111.141.93 이 글 공유하기…

  APT43 배후의 다단계 드롭박스 명령과 TutorialRAT — Genians · under “침해 지표 (Indicator of Compromise)” · published 2024-04-17 · pulled 2026-09-11

• …저장한다. 이후 server IP를 공격자 주소로 설정한 후 ‘Main’ method를 실행하여 공격자로부터 명령을 받아 키로깅, 브라우저 계정 정보 탈취, 화면 캡처 등의 악성 행위가 수행될 수 있다. C&C : 165.154.230.24:8020 생성된 각 파일의 기능은 다음과 같다. 파일명 기능 client.ps1 http://ky****ek.com/js/sub/aos/dull/down1/r_enc.bin 에서 추가 악성코드 다운로드 및…

  공공기관을 사칭하여 유포 중인 악성코드 주의(LNK) - ASEC — AhnLab ASEC · under “공공기관을 사칭하여 유포 중인 악성코드 주의(LNK)” · published 2023-11-09 · pulled 2026-09-11

• …This allows malicious behaviors such as keylogging, stealing browser account information, and taking screenshots. C&C: 165.154.230.24:8020 The features of each created file are as follows. Filename Feature client.ps1 Downloads and executes an…

  Warning Against Distribution of Malware Impersonating a Public Organization (LNK) - ASEC — AhnLab ASEC · under “Warning Against Distribution of Malware Impersonating a Public Organization (LNK)” · published 2023-11-08 · pulled 2026-09-11

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: APT43 배후의 다단계 드롭박스 명령과 TutorialRAT

Genians lists 6 other indicators in this source. 5 are shown, chosen across types.

• 1e66ac680d0edfe18d97b89e46c7e82e file hash
• a4bd6d00abbd79ab00161ff538cfe703 file hash
• eb08ab3854168c834ab154facfe695a3 file hash
• 183.111.141.93 IP address
• 218.150.78.197 IP address

All 7 indicators from this source

Cited by the same report: 공공기관을 사칭하여 유포 중인 악성코드 주의(LNK) - ASEC

AhnLab ASEC lists 6 other indicators in this source. 4 are shown, chosen across types.

• 0040aa9762c2534ac44d9a6ae7024d15 file hash
• 209ac4185dfc1e4d72c035ecb7f98eac file hash
• 40b7c3bced2975d70359a07c4f110f18 file hash
• 38.180.68.238 IP address

All 7 indicators from this source

Cited by the same report: Warning Against Distribution of Malware Impersonating a Public Organization (LNK) - ASEC

AhnLab ASEC lists 6 other indicators in this source. 2 are shown, chosen across types.

• 5e5a87d0034e80e6b86a64387779dc2e file hash
• 64dee04b6e6404c14d10971adf35c3a7 file hash

All 7 indicators from this source