`aurineuroth.com`

aurineuroth.com is a domain that 3 published sources report in connection with EtherHiding / UNC5342, unclustered DPRK and Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from Hokage Vanguard, Chollima Hunter (on-chain observation) and e Sentire. The earliest of those reports is dated 2026-03-09 and the most recent 2026-05-22.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0x8d7e3cc5342439ff28c589a902b685ea4d398c12`	Etherscan	Wallet, ethereum	owner wallet	EtherRAT	2026-03-09	2026-03-09
`0xe26c57b7fa8de030238b0a71b3d063397ac127d3`	Etherscan	Contract, ethereum	mapping contract	EtherRAT	2026-03-09	2026-03-09

domain EtherHiding / UNC5342DPRK (cluster unattributed)Lazarus Group CURATED

First seen 2026-03-09 · last seen 2026-05-22

Registration

Registered	2026-03-09
Registrar	Tucows Domains Inc.
Expires	2027-03-09
Last changed	2026-03-26
Status	active

From the registry’s RDAP record for aurineuroth.com, looked up 2026-10-05.

Sources

EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-03-09, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.
EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus — Hokage Vanguard · published 2026-05-22 · pulled 2026-10-03
EtherRAT command-and-control domain the operator wrote to the resolver contract on 2026-03-09, recovered by Hokage Vanguard from the contract's setString history and confirmed by this site from the same transactions. Registered through Tucows with Njalla nameservers, the registration pattern the report identifies across the campaign.
EtherRAT resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 — Chollima Hunter (on-chain observation) · published 2026-03-09 · pulled 2026-10-03
…EtherRAT C2 Domain palshona.com EtherRAT C2 Domain aurineuroth.com EtherRAT C2 IP 185.218.19.162 EtherRAT C2 Command Line…
EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons — e Sentire · under “Indicators of Compromise” · published 2026-03-25 · pulled 2026-10-03

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT Blockchain C2 Infrastructure Attributed to Lazarus

Hokage Vanguard lists 20 other indicators in this source. 5 are shown, chosen across types.

All 21 indicators from this source

Cited by the same report: EtherRAT resolver contract 0xe26c57b7fa8de030238b0a71b3d063397ac127d3

Chollima Hunter (on-chain observation) lists 14 other indicators in this source. 4 are shown, chosen across types.

All 15 indicators from this source

Cited by the same report: EtherRAT & SYS_INFO Module: C2 on Ethereum (EtherHiding), Target Selection, CDN-Like Beacons

e Sentire lists 18 other indicators in this source. 3 are shown, chosen across types.

All 19 indicators from this source