Chollima Hunter

← EtherHiding Tracker

cerumo.shop

cerumo.shop is a domain that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation). The report is dated 2026-03-31.

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

AddressTransactionTypeRoleMalware familyFirst writtenLast written
0x37ef6e88425613564b2cf8adc496acff4b6481a9 Etherscan Wallet, ethereum owner wallet EtherRAT 2026-03-31 2026-03-31
0xc12c8d8f9706244eca0acf04e880f10ff4e52522 Etherscan Contract, ethereum mapping contract EtherRAT 2026-03-31 2026-03-31

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-03-31 · last seen 2026-03-31

Registration

Registered2026-03-31
RegistrarGlobal Domain Group LLC
Expires2027-03-31
Last changed2026-09-30
Statusserver hold, client transfer prohibited

From the registry’s RDAP record for cerumo.shop, looked up 2026-10-05. A hold means the domain does not resolve, usually because the registrar or registry suspended it.

Source

  • EtherRAT command-and-control domain the operator wrote to the watchlisted resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 with setString on 2026-03-31, read by this site from the contract's write history. Recorded as the address the implant was pointed at, not as a host this site has observed serving anything. A domain an operator points an implant at can be a compromised legitimate site rather than one it registered.
    EtherRAT resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 — Chollima Hunter (on-chain observation) · published 2026-03-31 · pulled 2026-10-04

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522

Chollima Hunter (on-chain observation) lists 3 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.