Chollima Hunter

← EtherHiding Tracker

xororand.ru

xororand.ru is a domain that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation). The report is dated 2026-04-14.

DPRK link unconfirmed Found by this site's hunt in a chain-wide sweep for the DataUpdated(string,string) event; no published report covers it. The stored values are cryptocurrency-miner configurations, which points to a cryptojacking operation, and nothing ties it to North Korea. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

AddressTransactionTypeRoleMalware familyFirst writtenLast written
0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539 Wallet, polygon owner wallet reported
0x87db000f084f4a91f1aa6e00823f350e81316ef4 Contract, polygon cryptominer (unidentified) reported
0xa210e19de57555face122be5cdc57cc0636ddb1c Contract, polygon cryptominer (unidentified) reported
0xaa74f3f5f08c793a844e58dea1fa5ede97802004 Contract, polygon cryptominer (unidentified) reported
0xe6093262d241f0692a8094529d4bd4e7d540322d Contract, polygon cryptominer (unidentified) reported

domain EtherHiding CURATED

First seen 2026-04-14 · last seen 2026-04-14

Source

  • Mining pool or configuration server named on port 8080 in the XOR-encoded cryptocurrency-miner configurations stored on Polygon by 0x19532c0fbaf0fb8c1d0f3fac0b704bf2f4645539, first on 2026-04-14. Recorded as an address the miner was pointed at, not one this site has observed serving anything.
    Polygon transaction 0x467370f13a44cdd1d8f8c4bfcfd7d909b117156ca1a3b3385adb892304f2f2ad — Chollima Hunter (on-chain observation) · published 2026-04-14 · pulled 2026-10-20

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.