ThreatFox IOC Database

You are viewing the ThreatFox database entry for sha256_hash 017cb09cabd9c909e4fb06e8c668d2f89e472e103eda5230d98761a9f998bdb5.

Database Entry

Add tag Delete this IOC  Report False Positive Export IOC (JSON)    Export IOC (CSV)
IOC ID:1839900
IOC: 017cb09cabd9c909e4fb06e8c668d2f89e472e103eda5230d98761a9f998bdb5
IOC Type :sha256_hash
Threat Type :payload
Malware: BeaverTail
Confidence Level : Confidence level is high (100%)
Is compromised? : False
First seen:2026-06-30 04:50:28 UTC
Last seen:never
UUID:227dd6b0-73d7-11f1-97fa-42010aa4000a
Reporter fedfranz
Reward 5 credits from ThreatFox
Tags:BeaverTail chainvisitalabs ContagiousInterview DPRK

Avatar
fedfranz
DPRK Contagious Interview / Void Dokkaebi. Fake GitHub "assessment" repo (github.com/chainvisitalabs) → poisoned VS Code .vscode/settings.json → loader code-beautify.com →BeaverTail/InvisibleFerret Node.js infostealer. C2 172.86.123.37:8086/8087. Victim host compromised 2026-06-25.