G0067 - APT37

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018

Author
agomez
Created
2023-08-14 15:16:08
Last updated
2026-02-07 19:02:15
Downloads
305375
IPv4 indicators
1
Hostname indicators
57
Sample indicators
185

Download this feed in plain text, STIX2 or MISP format with a free Maltiverse account, or sync it natively into your security stack (SIEM, firewall, EDR, TIP) with 27+ integrations.

Latest Indicators of Compromise in this feed

azskk.com Hostname

modified 2026-10-17 08:40:33
Apt37 (Maltiverse)

sweetmonsterr.com Hostname

modified 2026-10-17 00:39:14
Apt37 (Maltiverse) · Top Popularity Site (Cisco Umbrella) · Unsafe.AI_Score_79% (Hybrid-Analysis) · Covid19 scam (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition)

defenderlive.com Hostname

modified 2026-10-17 00:38:12
Apt37 (Maltiverse)

attiferstudio.com Hostname

modified 2026-10-17 00:37:26
Apt37 (Maltiverse)

thegymmum.com Hostname

modified 2026-10-16 20:35:25
Apt37 (Maltiverse) · Top Popularity Site (Cisco Umbrella)

ticket.ipv10.eu Hostname

modified 2026-10-16 16:38:37
Apt37 (Maltiverse)

srdm.in Hostname

modified 2026-10-16 16:35:54
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch) · VB:Trojan.Valyria (Hybrid-Analysis) · Malware (Hybrid-Analysis) · Malware Download (Abuse.ch)

grab-indonesia.com Hostname

modified 2026-10-16 16:35:54
Apt37 (Maltiverse)

dialog.gg Hostname

modified 2026-10-16 16:34:15
Apt37 (Maltiverse)

autopartslife.com Hostname

modified 2026-10-16 16:33:00
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

indomobilhino.co.id Hostname

modified 2026-10-16 12:38:13
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

www.boja.us Hostname

modified 2026-10-16 12:34:11
Apt37 (Maltiverse)

camaralastro.pb.gov.br Hostname

modified 2026-10-16 12:33:42
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

cyberchef.net Hostname

modified 2026-10-16 08:36:47
Apt37 (Maltiverse)

gopackapp.com Hostname

modified 2026-10-16 00:39:51
Apt37 (Maltiverse) · Neshta.A (Hybrid-Analysis) · DeepScan:Generic.Ransom.Sodinokibi (Hybrid-Analysis)

zampoint.com Hostname

modified 2026-10-15 12:36:42
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

burgant.com Hostname

modified 2026-10-15 12:36:41
Apt37 (Maltiverse)

148.251.234.93 IPv4

modified 2026-10-13 00:45:18
Apt37 (Maltiverse) · RedLineStealer (Maltiverse Research Team) · DangerousSig [Trj] (Hybrid-Analysis) · Malicious site (Hybrid-Analysis) · Dropper.Trojan.Agent (Hybrid-Analysis)

d0aa862e7e3d80ed48ab0bfe0eb3dec8 Sample

modified 2026-10-07 11:15:51
Apt37 (Maltiverse) · Generic.Malware (Abuse.ch)

e9a006e6c407decd13f6fe02934482f4.exe Sample

modified 2026-10-05 04:06:47
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis) · Spyware (VM-Ray) · Vidar (MalwareBazaar Abuse.ch)

c8aa088219b5afcf0dd7d02debe430c259404cf2461bfa62f4fffa814d65ec10.exe Sample

modified 2026-09-28 15:41:25
Apt37 (Maltiverse) · Spyware (VM-Ray) · Keylogger (VM-Ray) · RemcosRAT (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

01b6219a2713c7ed9a037b57c11cb633.exe Sample

modified 2026-09-28 10:10:14
Apt37 (Maltiverse) · RedLineStealer (MalwareBazaar Abuse.ch)

file.exe Sample

modified 2026-09-27 13:32:49
Apt37 (Maltiverse) · Spyware (VM-Ray) · ArkeiStealer (MalwareBazaar Abuse.ch)

b7b007a29f6cc7068c1efbe2fdc45f31.exe Sample

modified 2026-09-18 06:31:53
Apt37 (Maltiverse) · RedLineStealer (MalwareBazaar Abuse.ch)

liveupdates2000.com Hostname

modified 2026-09-18 06:28:26
Apt37 (Maltiverse) · Gen:Variant.Barys (Hybrid-Analysis) · Gen:Variant.Strictor (Hybrid-Analysis) · Backdoor.Generic (Hybrid-Analysis)

letrebone.com Hostname

modified 2026-09-18 06:28:07
Apt37 (Maltiverse) · Quant (Cybercrime-tracker.net) · VB:Trojan.Valyria (Hybrid-Analysis)

zonestatistic.com Hostname

modified 2026-09-18 06:25:02
Apt37 (Maltiverse)

gofootball24h.com Hostname

modified 2026-09-18 06:24:57
Apt37 (Maltiverse)

dropboxengine.com Hostname

modified 2026-09-18 06:23:19
Backdoor.PowerShell.Agent (Hybrid-Analysis) · Apt37 (Maltiverse)

kinross.xyz Hostname

modified 2026-09-18 06:21:44
Apt37 (Maltiverse)

89gospel.com Hostname

modified 2026-09-18 06:19:20
Apt37 (Maltiverse) · backdoor,ransomware,svg (Maltiverse) · backdoor (Maltiverse) · Trojan.Generic (Hybrid-Analysis) · Artemis (Hybrid-Analysis)

myinvestgroup.com Hostname

modified 2026-09-18 06:19:05
Apt37 (Maltiverse) · apt,apt28 (Maltiverse) · Malicious Host (APT Notes) · Malware site (Hybrid-Analysis)

carillon7tanphu.com Hostname

modified 2026-09-18 06:19:03
Apt37 (Maltiverse)

womenempowermentpakistan.com Hostname

modified 2026-09-18 06:19:01
Apt37 (Maltiverse) · Emotet (Abuse.ch) · W97M.Downloader (Hybrid-Analysis) · Malicious site (Hybrid-Analysis) · Generic.Malware (Hybrid-Analysis)

vipnightsgirls.com Hostname

modified 2026-09-18 06:19:01
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

cone.msoftupdates.com Hostname

modified 2026-09-18 06:19:00
Apt37 (Maltiverse) · IOC_03032020 (CronUp Threat Intel)

ctwo.msoftupdates.com Hostname

modified 2026-09-18 06:18:59
Apt37 (Maltiverse) · Malware site (Hybrid-Analysis) · IOC_03032020 (CronUp Threat Intel)

dreamconstructionhome.com Hostname

modified 2026-09-18 06:12:46
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

global-sc-ltd.com Hostname

modified 2026-09-18 06:12:45
Apt37 (Maltiverse)

allomarca.com.br Hostname

modified 2026-09-18 06:12:40
Apt37 (Maltiverse) · Malware Download (URLhaus Abuse.ch)

valenciahillscondo.com Hostname

modified 2026-09-18 06:10:34
Apt37 (Maltiverse) · VB:Trojan.VBA.Agent (Hybrid-Analysis)

ns3215834.ip-146-59-69.eu Hostname

modified 2026-09-18 06:10:16
Apt37 (Maltiverse)

imersaomaster.com.br Hostname

modified 2026-09-18 06:05:35
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

coreupdate.msoftupdates.com Hostname

modified 2026-09-18 06:04:25
Apt37 (Maltiverse) · Malware (Hybrid-Analysis) · evasive,msil (Maltiverse) · IOC_03032020 (CronUp Threat Intel) · HEUR:Trojan.MSIL.APosT (Hybrid-Analysis)

easyshare-77827280306.xyz Hostname

modified 2026-09-18 06:01:59
Apt37 (Maltiverse) · Malware Download (URLhaus Abuse.ch)

id.82610425-easyshare.click Hostname

modified 2026-09-18 06:00:53
Apt37 (Maltiverse) · Malware Download (URLhaus Abuse.ch)

id.43349568-easyshare.click Hostname

modified 2026-09-18 06:00:49
Apt37 (Maltiverse) · Malware Download (URLhaus Abuse.ch)

easyshare-33644049147.click Hostname

modified 2026-09-18 06:00:40
Apt37 (Maltiverse) · Malware Download (URLhaus Abuse.ch)

www.dicemention.com Hostname

modified 2026-09-18 06:00:34
Apt37 (Maltiverse)

RIP_YOUR_PC_LOL.exe Sample

modified 2026-09-03 12:42:33
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis) · njrat (MalwareBazaar Abuse.ch) · DCRat (ThreatFox Abuse.ch)

uber-asia.com Hostname

modified 2026-08-28 23:14:16
Apt37 (Maltiverse)

club2crd.cc Hostname

modified 2026-08-26 06:47:49
Apt37 (Maltiverse)

RokRat.dll.bin Sample

modified 2026-08-02 11:04:04
Generic.Malware (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis) · APT37 (MalwarePatrol)

secondlivve.com Hostname

modified 2026-08-02 06:19:00
Top Popularity Site (Cisco Umbrella) · Apt37 (Maltiverse) · Malicious URL (Hybrid-Analysis)

purch-int.com Hostname

modified 2026-07-30 11:30:51
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

graphicforests.com Hostname

modified 2026-07-12 06:13:02
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

code.ryanbruzan.net Hostname

modified 2026-07-08 08:05:44
Apt37 (Maltiverse)

fa24b7c4c3dc0c6d0b942eb96e4f18a0 Sample

modified 2026-04-29 05:49:06
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis) · Formbook (MalwareBazaar Abuse.ch)

7527323a12bb2682047a438f8eb0b1ea4049e0733202fe0597e48dc00c1f23a4.exe Sample

modified 2026-04-20 03:23:36
Apt37 (Maltiverse) · Backdoor (VM-Ray) · Keylogger (VM-Ray) · njrat (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

3135cb02651ef142e39283472f7e214147eede727b35eb0ac03f3c09a98e3644 Sample

modified 2026-04-19 02:07:18
Apt37 (Maltiverse)

1975ea1d437653a1bc85896525a10bc938674f1d8dd2434ce28db459e8289091 Sample

modified 2026-04-11 04:14:44
Apt37 (Maltiverse)

2025 북한인권 청년 아카데미 강의 주제.pdf.lnk Sample

modified 2026-04-06 06:34:52
ROKRAT (MalwareBazaar Abuse.ch) · APT37 (MalwarePatrol)

shebronzy3.1.exe Sample

modified 2026-04-04 04:21:13
Apt37 (Maltiverse) · Formbook (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

0x000700000001e6af-1 Sample

modified 2026-03-25 02:14:16
ROKRAT (MalwareBazaar Abuse.ch) · APT37 (MalwarePatrol)

0b6df94a47ea02db784376c55f2f099fbe33047436178321070d79f81cd55c35 Sample

modified 2026-03-03 18:12:24
APT37 (MalwarePatrol)

www.blackriverdistribution.com Hostname

modified 2026-03-01 00:26:55
Apt37 (Maltiverse)

atvcampingtrips.com Hostname

modified 2026-02-18 06:06:35
Apt37 (Maltiverse) · Top Popularity Site (Cisco Umbrella)

7e93bacbbc33e6652e147e7fe07572a0 Sample

modified 2026-01-16 00:03:43
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis) · Generic.Malware (MalwareBazaar Abuse.ch)

86fb47fce668ff29a49fe474f1170528e208c5cd62af7489a0462238af8df670.exe Sample

modified 2025-12-19 00:23:38
Apt37 (Maltiverse) · Backdoor (VM-Ray) · Keylogger (VM-Ray) · Generic Malware (Hybrid-Analysis)

System.exe Sample

modified 2025-12-16 01:01:17
Trojan.Generic (Hybrid-Analysis) · Apt37 (Maltiverse)

ad85442ee6ba3f66771fbc0adf5de628 Sample

modified 2025-11-24 05:18:49
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis) · GuLoader (MalwareBazaar Abuse.ch)

04074299.exe Sample

modified 2025-11-24 00:10:45
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis)

07715799.exe Sample

modified 2025-11-01 17:37:25
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis)

piwixesu.pro Hostname

modified 2025-08-08 00:17:32
Apt37 (Maltiverse)

biz9holdings.com Hostname

modified 2025-05-04 00:04:32
Apt37 (Maltiverse) · Malware Download (Abuse.ch) · Covid19 scam (Cyber Threat Coalition) · Malicious url (Cyber Threat Coalition) · Malicious Hostname (Cyber Threat Coalition)

f0b85c3d890019c1d88274fb49f4caa52d696917a418ffee89324ad40d0076c9.exe Sample

modified 2025-04-21 11:41:10
Generic Malware (Hybrid-Analysis) · Apt37 (Maltiverse) · Backdoor (VM-Ray)

01f7a3923f3afd42b4ff59a0e4d9add5b9ce228ca041a2614c5cef8bf6d8a665.exe Sample

modified 2024-10-23 02:45:09
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis)

thedresserie.com Hostname

modified 2024-10-17 14:01:54
Apt37 (Maltiverse)

eeea40ff5b8e4b55bb571b607cfee8ac941083bc41c69884e6ce8d4f1150a462.exe Sample

modified 2024-06-07 00:17:57
Apt37 (Maltiverse) · Spyware (VM-Ray) · Keylogger (VM-Ray)

dc.exe Sample

modified 2023-10-24 04:45:11
Apt37 (Maltiverse) · Generic.Malware (MalwareBazaar Abuse.ch) · Generic Malware (Hybrid-Analysis)

cthree.msoftupdates.com Hostname

modified 2023-07-05 20:51:43
Apt37 (Maltiverse) · IOC_03032020 (CronUp Threat Intel)

ed5tfdhjy.click Hostname

modified 2023-07-05 20:51:37
Apt37 (Maltiverse)

id.42875677-easyshare.xyz Hostname

modified 2023-07-05 20:51:32
Apt37 (Maltiverse) · Malware Download (URLhaus Abuse.ch)

madformennesker.dk Hostname

modified 2023-07-05 20:51:25
Apt37 (Maltiverse) · QakBot (ThreatFox Abuse.ch)

f57dc054008a6db763dd0d87619bbafd55ff81301a6d858d3e7a1f585ab21c36 Sample

modified 2023-07-05 20:51:13
Apt37 (Maltiverse)

fcd39f5a96b4193007c4556cb98b123e831fd58ef157d5455c4cc17ffabbe313 Sample

modified 2023-07-05 20:51:13
Apt37 (Maltiverse)

f333289bf29805ee697908ecb974aeb81206b471252ec.exe Sample

modified 2023-07-05 20:51:13
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis)

e98ed1f0bf9eb6de420c0f0070bad24d14d43eb55315eba08856cd81d6a4b484.exe Sample

modified 2023-07-05 20:51:12
Apt37 (Maltiverse) · RustyStealer (MalwareBazaar Abuse.ch) · Generic.Malware (MalwareBazaar Abuse.ch) · Spyware (VM-Ray)

e94f3e56345a0a4fa3708997810c074312c8234c7065bd3205583b46ef483831 Sample

modified 2023-07-05 20:51:11
Apt37 (Maltiverse)

dd8e8ca895b2362f220e58f42294b07d8b8c47fc6d662700166ed6b607829f58 Sample

modified 2023-07-05 20:51:11
Apt37 (Maltiverse)

dcbb9687d55524f5c11b88119a0c567266d2ffa1c4fbf92f64a8bec74a2efde9 Sample

modified 2023-07-05 20:51:11
Apt37 (Maltiverse)

e923dcd00e2537ea877ee29b64d9385d50926d19ba17b9c073880f51b21d0dcf Sample

modified 2023-07-05 20:51:11
Apt37 (Maltiverse)

c2cdd69ef94a65fd719fbceb659aaa0d4f273a8c76ce345def0a1818712557ce Sample

modified 2023-07-05 20:51:10
Apt37 (Maltiverse)

ac4af7de886fab57800f3f7b7a498be06d9225ac69dfc11bc26a96b2fc86221b Sample

modified 2023-07-05 20:51:09
Apt37 (Maltiverse)

b5ad923495578eb3601886976fcf279e545b8f266411f0f2e97ff4c5015deb43 Sample

modified 2023-07-05 20:51:09
Apt37 (Maltiverse)

abc81b48d2813de2481d23d256330c7e830ba04493aab62b68029c47607e3fad Sample

modified 2023-07-05 20:51:09
Apt37 (Maltiverse)

ba4f35460d5d92a30236eb9b10fcb0493af4112cd21b11da70211ce18e27c010 Sample

modified 2023-07-05 20:51:09
Apt37 (Maltiverse)

b765ff113cf1373281b31bc7ee1ad75af9607e7efe5b60af2fcc160f5b4344fd Sample

modified 2023-07-05 20:51:09
Apt37 (Maltiverse)

9fff435c1c7e03c01547bc4df5f2171507edbc41234f535fab8af43693933bf2 Sample

modified 2023-07-05 20:51:08
Apt37 (Maltiverse)

tloader.exe Sample

modified 2023-07-05 20:51:08
Apt37 (Maltiverse) · Generic Malware (Hybrid-Analysis)