SHA256MediumSignal 100/100
c2500a6e12f22b16e221ba01952b69c92278cd05632283d8b84c55c916efe27c
Location
Korea, Democratic People's Republic ofFirst Seen
Sep 3, 2023
Last Seen
Apr 30, 2026
Found in 6 reports. Confidence: medium. · Confidence scores are heuristic. Verify before acting on results.
SHA-256 Hash
SHA-256 file hash — primary identifier for malware samples.
MISP Category
Artifacts Dropped
Hash Algorithm
SHA256
Confidence
99%
Signal Score
100 / 100
IDS Rule
No
Threat Context
Tags
MITRE ATT&CK
MITRE ATT&CK TTPs
Feed Intelligence Summary
6 reports99% confidence
6
Source reports
99%
Confidence score
Category tags
.netactive scanningaerospace & defenseandarielandariel groupandarloaderaptascii textasiaattackautomotive manufacturingazaz09blackblack ratbotnetbrute forcebuilding constructionc serverc++calls processcheckincisacivil servicescommand and controlcommand executioncommunication protocolconnection3aconstruction materialsconstruction safetyconstruction technologyconsumer electronicscoreacredential accesscredential stuffingcrlf linecveidcyberdarkseouldata encryptiondata exfiltrationdatabase securitydefensedefense contractingdefense evasiondefense logisticsdefense systemsdefense technologydenial of servicedistributed attacksdistribution managementdoradprkdrops pedtrackelectronic componentselectronic designelectronic engineeringelectronic health recordselectronic manufacturingelectronic testingelectronics manufacturingembedded systemsenergyenergy distributionengineeringenterprise securityet malwareexeexploitation activityfilefile-hashfinfirstformbook cncfreight forwardingftpftp brute forcego programming languagegoatgoat ratgoatratgovernment technologyh0lygh0sthealth care and social assistancehealth information technologyhealthcare information systemshidden cobrahipshomenethospital managementhttp brute forcehttp scannerindicatorindustrial automationindustrial iotindustrial productionindustry/defenseindustry/transportation and warehousingindustry/utilitiesinformation technologyinfostealeringress tool transferinitial accessinjection attacksinnorix agentinsertintrusion detectioninventory managementit infrastructurekimsukykorea, democratic people's republic ofkoreanlateral movementlazaruslog4jlogistics technologylookmagicratmajormalmalicious activitymalicious downloadmalicious powershell activitymalicious softwaremalwaremalware distributionmalwaretype/remote access trojanmanufacturing technologymedical servicesmilitary operationsmoderatenational securitynetwork attacksnetwork intrusionnetwork probingnetwork protocolnetwork scanningnetwork securitynextnorth koreanuclearoil & gasonyx sleetpatch managementpatient carepe fileperiodphishingpower generationpower systemsprocess injectionprocess manufacturingprojectpublic administrationpublic infrastructurepublic policyquality controlratsrbgreconnaissancereconnaissance general bureauregulatory agenciesremote accessremote servicesrenewable energyresearchedrifdoorrustscannerscripting attackssemiconductor technologyshellshipping servicessilent chollimasliversoftware developmentsoftware vulnerabilitiessouth koreaspawnsssh attackstrongsupply chain attacksupply chain managementsynt1003t1005t1014t1016t1018t1021t1021.001t1021.002t1027t1036t1039t1040t1047t1048t1049t1055t1056t1057t1059t1059.001t1059.003t1059.004t1059.005t1068t1071t1071.001t1071.002t1071.004t1076t1077t1078t1082t1083t1086t1087t1090t1105t1110t1110.001t1110.002t1110.003t1112t1113t1119t1129t1189t1190t1204.002t1210t1486t1496t1497t1499.001t1499.002t1499.003t1518t1547t1560t1562t1563t1565t1566t1566.001t1567t1569t1569.002t1572t1587t1588t1588.002t1589t1589.002t1590t1590.001t1590.002t1590.003t1590.004t1591t1592t1592.001t1592.002t1592.003t1595t1595.001t1595.002t1595.003t1596tcp protocoltdrop2themidathreat actorthreat intelligencethreatactor/onyx sleetthreattype/malwarethreattype/threat actorthreattype/vulnerability exploitationtigerrattransportation and warehousingtransportation managementtroytroy reversetwitterunauthorized access attemptunitedusersvolgmerwarehouse operationsweb loginweb trafficwindows sandboxxmasyara
Activity Timeline
Apr 30Apr 30
Threat Activity Heatmap
· Peak: 2026-04-30LessMore
Mon
Wed
Fri
24h
0
Dormant
7d
0
Dormant
30d
0
Dormant
3mo
1
Minimal
Threat ScoreHigh Risk
100
SIGNAL
Signal Score
99%
Confidence
6
Reports
First seenSep 3, 2023
Last seenApr 30, 2026
VirusTotal
Not checked
WHOIS
- description
- This is a pulse created to house CND internal IOCs that we want to monitor, please add title to explain what the IOC and a further description of if this is needed.
- references
- https://www.microsoft.com/en-us/security/blog/2024/07/25/onyx-sleet-uses-array-of-malware-to-gather-intelligence-for-north-korea/, https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-207a, https://asec.ahnlab.com/en/56405/, https://www.microsoft.com/en-us/security/blog/2024/07/25/onyx-sleet-uses-array-of-malware-to-gather-intelligence-for-north-korea/#:~:text=Indicators%20of%20compromise, https://www.cisa.gov/sites/default/files/2024-07/AA24-207A-North-Korea-Cyber-Group-Conducts-Global-Espionage-Campaign-to-Advance-Regimes-Military-and-Nuclear-Programs.stix_.json, https://media.defense.gov/2024/Jul/25/2003510137/-1/-1/0/Joint-CSA-North-Korea-Cyber-Espionage-Advance-Military-Nuclear-Programs.PDF, https://www.ic3.gov/Media/News/2024/240725.pdf, https://www.ncsc.gov.uk/news/ncsc-partners-vigilant-dprk-sponsored-cyber-campaign, https://labs.inquest.net/iocdb, https://thehackernews.com/2023/09/researchers-warn-of-cyber-weapons-used.html
Export & API
STIX 2.1 Bundle
CSV Export
Permalink
IOC Journey
mediumFirst detected 2 years ago · Last seen 1 month ago
Appeared in 6 threat reports