← EtherHiding Tracker

jariosos.com

jariosos.com is a domain that 3 published sources report in connection with EtherHiding / UNC5342, unclustered DPRK and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Hokage Vanguard, Chollima Hunter (on-chain observation) and e Sentire. The earliest of those reports is dated 2026-01-20 and the most recent 2026-05-22.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

domain EtherHiding / UNC5342DPRK (cluster unattributed)Lazarus Group CURATED

First seen 2026-01-20 · last seen 2026-05-22

Registration

From the registry’s RDAP record for jariosos.com, looked up 2026-10-05.

Sources

• EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-01-20, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.

  EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus — Hokage Vanguard · published 2026-05-22 · pulled 2026-10-03

• EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-01-20, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.

  EtherRAT resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 — Chollima Hunter (on-chain observation) · published 2026-01-20 · pulled 2026-10-03

• …https://nodejs.org/dist/v18.17.0/node-v18.17.0-win-x64.zip Node.js download URL Domain jariosos.com EtherRAT C2 Domain hayesmed.com EtherRAT C2 Domain…

  EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons — e Sentire · under “Indicators of Compromise” · published 2026-03-25 · pulled 2026-10-03

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus

Hokage Vanguard lists 20 other indicators in this source. 5 are shown, chosen across types.

• justtalken.com domain
• 206.165.76.171 IP address
• 46.38.156.25 IP address
• 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 smart contract address
• 0x8d7e3cc5342439ff28c589a902b685ea4d398c12 cryptocurrency wallet address

All 21 indicators from this source

Cited by the same report: EtherRAT resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3

Chollima Hunter (on-chain observation) lists 14 other indicators in this source. 4 are shown, chosen across types.

• mebeliotmasiv.com domain
• o-parana.com domain
• palshona.com domain
• regancontrols.com domain

All 15 indicators from this source

Cited by the same report: EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons

e Sentire lists 18 other indicators in this source. 3 are shown, chosen across types.

• 47f74749cfcd55c8dacde2cc9b4c45282bec7a93ee19b7b81b452c99758d3370 file hash
• 5623f4f8942872b2b7cb6d2674c126a42bdf6ed5d1f37c1afc348529e4697d73 file hash
• 185.218.19.162 IP address

All 19 indicators from this source