Chollima Hunter

← EtherHiding Tracker

okhash.org

okhash.org is a domain that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation). The report is dated 2026-03-19.

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

AddressTransactionTypeRoleMalware familyFirst writtenLast written
0x45729d7424d7310a0c041a2906ba95a4bd5ebfca Etherscan Contract, ethereum mapping contract EtherRAT 2026-03-19 2026-03-19
0xa001d3863b138ed523f255f62725ab1ddc82af87 Etherscan Wallet, ethereum owner wallet EtherRAT 2026-03-19 2026-03-19

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-03-19 · last seen 2026-03-19

Registration

Registered2026-03-19
RegistrarTucows Domains Inc.
Expires2027-03-19
Last changed2026-08-12
Statusclient hold, client transfer prohibited, client update prohibited

From the registry’s RDAP record for okhash.org, looked up 2026-10-05. A hold means the domain does not resolve, usually because the registrar or registry suspended it.

Source

  • EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca with setString on 2026-03-19, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.
    EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca — Chollima Hunter (on-chain observation) · published 2026-03-19 · pulled 2026-10-04

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca

Chollima Hunter (on-chain observation) lists 14 other indicators in this source. 12 are shown, chosen across types.

All 15 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.