← EtherHiding Tracker

necropatia.com

necropatia.com is a domain that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Decryption Digest. The report is dated 2026-07-08.

DPRK link unconfirmed Unit 42, as reported by Decryption Digest, attributes this campaign to an unidentified actor; no DPRK attribution is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

domain EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-07-08 · last seen 2026-07-08

Registration

From the registry’s RDAP record for necropatia.com, looked up 2026-10-11.

Source

• As printed:

  If blockchain resolution fails, EtherRAT falls back to the hardcoded domain necropatia[.]com.

  Notes:

  Fallback command-and-control domain hardcoded in EtherRAT in the fake Microsoft Teams IT-support campaign, used when the resolver contract 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f cannot be read.

  EtherRAT Microsoft Teams Attack: Blockchain C2 Hits Finance — Decryption Digest · published 2026-07-08 · pulled 2026-10-11

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT Microsoft Teams Attack: Blockchain C2 Hits Finance

Decryption Digest lists 3 other indicators in this source.

• camorreado.click domain
• 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f smart contract address
• 0x788a5336c0ef70be87619a3c13a43050c426f7ec smart contract address