Sony/Destover: mystery North Korean actor’s destructive and past
network activity
By Kurt Baumgartner
Published: 2014-12-04 · Archived: 2026-04-05 19:46:10 UTC
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:00:00:00:00:01:10:0c:98:3a:31
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=BE, O=GlobalSign nv-sa, OU=ObjectSign CA, CN=GlobalSign ObjectSign CA
        Validity
            Not Before: Jan 10 15:20:07 2007 GMT
            Not After : Jan 10 15:20:07 2010 GMT
        Subject: C=VG, O=EldoS Corporation, CN=EldoS Corporation/emailAddress=info@eldos.com
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (1024 bit)
                Modulus:
                    00:d7:60:2f:bf:3c:85:1b:f3:a1:19:8c:4d:0e:49:
                    c5:a5:f5:16:15:b6:ea:91:e2:c2:92:7b:d6:e5:2a:
                    1e:68:8c:7b:28:eb:07:dc:b0:3a:dd:11:ee:84:a9:
                    8b:6f:04:b0:ae:c2:2d:bc:b7:56:41:61:e1:ae:01:
                    0d:0e:83:47:00:3a:ca:b5:12:fb:e5:b6:55:ac:e0:
                    94:00:5b:e0:61:70:24:ba:d9:ef:4a:e2:af:8f:21:
                    93:9e:8b:83:17:2a:e4:3d:74:e6:07:c8:4a:69:ed:
https://securelist.com/destover/67985/
Page 1 of 5

60:9b:89:6e:5b:85:50:49:52:f9:fa:91:63:9f:61:
                    a7:ea:e2:3e:d7:1b:07:22:a1
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            Netscape Cert Type:
                Object Signing
            X509v3 Key Usage: critical
                Digital Signature, Non Repudiation, Key Encipherment, Data Encipherment
            X509v3 Authority Key Identifier:
                keyid:D2:5B:F3:4B:26:4B:A5:B0:E7:5D:FD:56:7F:F6:F1:2E:38:4E:53:A0
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl.globalsign.net/ObjectSign.crl
    Signature Algorithm: sha1WithRSAEncryption
         44:0d:5b:2c:f4:c3:c0:91:c0:9f:4d:91:f0:25:5c:79:72:ff:
         82:7a:a8:97:fb:08:2b:c2:eb:ae:4b:78:b6:a8:0f:5b:3a:1d:
         12:c9:07:81:d0:16:e0:94:1e:69:3c:43:c1:d8:85:b1:4c:1a:
         21:84:1c:c8:ed:0a:7e:e4:55:b7:f8:ae:69:a8:b0:8c:10:da:
         6e:57:f4:a3:62:5b:2b:4f:06:25:a9:35:f0:63:cc:3f:e0:f6:
         4c:ee:1d:d8:9f:d8:ae:d3:fe:de:3b:0b:c5:f3:19:1c:2a:37:
         ad:0d:5c:87:5e:da:8f:31:02:d3:78:5d:f1:30:28:78:c3:86:
         f7:b2:f6:6c:2d:d8:45:8a:8b:16:eb:bb:d0:6e:5b:98:68:8e:
         9b:cc:7e:77:9d:0d:b3:5f:01:d8:57:26:6d:cf:85:2a:46:52:
         0f:79:93:85:f7:19:14:01:73:d5:03:e7:96:1a:16:cd:24:0b:
         67:6d:f9:72:55:b8:b9:e9:be:07:58:b3:01:bd:a1:18:57:bb:
         b3:19:e5:88:0e:f5:96:fe:eb:b8:66:a6:c6:2c:62:b5:21:59:
https://securelist.com/destover/67985/
Page 2 of 5

f2:d9:4d:2b:d1:59:20:07:13:78:26:dc:d5:b3:d1:55:47:5e:
         2e:cb:cb:cc:04:7c:d5:e2:9d:7c:24:b1:18:70:da:1f:54:5b:
         59:88:d1:17
    Data:
        Version: 3 (0x2)
        Serial Number:
            01:e2:b4:f7:59:81:1c:64:37:9f:ca:0b:e7:6d:2d:ce
    Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID Code Signing CA-1
        Validity
            Not Before: Sep 18 00:00:00 2012 GMT
            Not After : Sep 22 12:00:00 2015 GMT
        Subject: C=US, ST=California, L=CULVER CITY, O=Sony Pictures Entertainment Inc., CN=Sony Pictures
Entertainment Inc.
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                Public-Key: (2048 bit)
                Modulus:
                    00:b6:08:80:f6:6d:9c:3a:f4:fb:45:bc:bd:6a:27:
                    e5:97:23:fa:6a:5d:39:08:97:37:53:13:70:85:1b:
                    0e:08:b1:b7:5f:e3:78:6e:b1:6b:26:7a:82:86:f8:
                    37:2d:b0:b2:65:f0:8a:56:c7:e1:1a:88:19:f9:00:
                    bd:c3:4b:8d:97:10:b6:9a:09:14:8d:95:0a:75:56:
                    cd:c5:2f:1c:ad:21:82:cb:8c:ad:8d:78:11:1e:b8:
                    50:94:90:96:7a:e4:69:38:9c:bd:2f:4c:8c:2b:23:
                    45:f1:ac:59:2f:10:12:d4:64:3a:9b:41:5d:14:2b:
                    56:10:eb:c6:15:ed:1d:f0:06:d3:0e:9e:96:8e:c1:
https://securelist.com/destover/67985/
Page 3 of 5

0e:cf:62:17:7c:c7:a9:d5:2a:40:99:d6:a2:68:93:
                    f6:02:2a:1e:95:e6:1e:a4:d6:c4:fd:61:7d:d7:15:
                    9a:1f:2d:ab:4e:fc:61:9f:d8:54:55:8e:79:d3:57:
                    8a:22:14:31:d4:a4:4e:a5:43:ec:4b:35:04:8d:f8:
                    10:37:10:3f:bb:2a:ae:b7:b8:a1:16:f4:f6:02:df:
                    97:fc:32:95:97:38:23:48:c2:96:b3:aa:9f:88:66:
                    26:eb:d4:70:38:2f:84:b1:e0:1e:a1:27:5f:3f:14:
                    b7:dd:4c:f2:c7:22:6a:1a:f8:85:1a:57:23:b3:c7:
                    58:1f
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Authority Key Identifier:
                keyid:7B:68:CE:29:AA:C0:17:BE:49:7A:E1:E5:3F:D6:A7:F7:45:8F:35:32
            X509v3 Subject Key Identifier:
                51:6E:D7:E5:BB:2E:FD:39:6B:0D:37:D5:D0:70:6B:5A:8C:D6:11:F8
            X509v3 Key Usage: critical
                Digital Signature
            X509v3 Extended Key Usage:
                Code Signing
            X509v3 CRL Distribution Points:
                Full Name:
                  URI:http://crl3.digicert.com/assured-cs-2011a.crl
                Full Name:
                  URI:http://crl4.digicert.com/assured-cs-2011a.crl
            X509v3 Certificate Policies:
                Policy: 2.16.840.1.114412.3.1
https://securelist.com/destover/67985/
Page 4 of 5

CPS: http://www.digicert.com/ssl-cps-repository.htm
                  User Notice:
                    Explicit Text:
            Authority Information Access:
                OCSP - URI:http://ocsp.digicert.com
                CA Issuers - URI:http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt
            X509v3 Basic Constraints: critical
                CA:FALSE
    Signature Algorithm: sha1WithRSAEncryption
         90:0f:0b:0f:93:f7:77:e7:34:dc:b4:2a:7e:bd:d1:0f:05:ac:
         a5:9d:c8:1c:77:18:cd:28:90:28:e7:c6:ac:ad:f9:9e:b0:c6:
         74:db:da:8c:b2:38:06:c5:a0:e4:cd:66:e4:ef:f7:21:58:1f:
         9a:4f:17:3c:e1:af:c3:67:1e:37:ab:2a:2b:8f:7d:bc:9e:eb:
         9b:f5:aa:c0:24:80:70:63:b0:2a:10:54:27:01:12:ec:61:12:
         97:2d:98:c5:6f:e5:7e:1c:7c:17:2c:f5:ad:40:fb:b2:44:40:
         fa:e1:02:45:22:7d:6f:6d:04:fc:ff:2c:d2:e5:2f:3e:49:5c:
         72:4b:0c:5a:ce:6e:13:44:79:f9:b9:26:d9:2e:6f:4d:05:72:
         0d:d2:e9:bc:66:88:af:63:5b:1b:44:50:a4:c7:e4:bc:73:d6:
         ac:25:7c:1a:88:37:c2:71:3f:1c:32:38:32:12:55:75:db:55:
         6d:d9:1e:40:a7:d3:35:f4:bf:86:a3:72:60:49:c3:a4:9a:2e:
         4d:5d:0d:4d:97:2b:34:91:5c:e1:e6:a9:93:eb:d2:62:2a:ef:
         a1:73:6e:a4:0b:22:d4:31:a8:d5:53:9d:26:29:e1:1c:4a:04:
         c5:8a:df:15:01:42:6f:a2:b3:3b:da:2e:e5:4c:b5:53:6b:76:
         86:b2:25:29  
Source: https://securelist.com/destover/67985/
https://securelist.com/destover/67985/
Page 5 of 5