tsmpl.centralus.cloudapp.azure.com
tsmpl.centralus.cloudapp.azure.com is a domain
that 4 published sources report
in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Sysdig.
The reports are dated 2026-11-06.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0x45729d7424d7310a0c041a2906ba95a4bd5ebfca |
Etherscan | Contract, ethereum | mapping contract | EtherRAT | 2026-11-06 | 2026-11-06 |
0x6e044e19000487c4a6e6af15b4132a5561b5ee1f |
Etherscan | Contract, ethereum | mapping contract | EtherRAT | 2026-11-06 | 2026-11-06 |
0x788a5336c0ef70be87619a3c13a43050c426f7ec |
Etherscan | Contract, ethereum | mapping contract | EtherRAT | 2026-11-06 | 2026-11-06 |
0xa001d3863b138ed523f255f62725ab1ddc82af87 |
Etherscan | Wallet, ethereum | owner wallet | EtherRAT | 2026-11-06 | 2026-11-06 |
domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED
Sources
-
Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-06 (transaction 0x8dd774b7690d9542bac406d96c52f8ab0ee5d1f9c40ae077decbb618237b9309), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. It replaced rversl.centralus.cloudapp.azure.com, written two days earlier, and was itself replaced by basodara.com four days later. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x0a77e721b149eace6c7c1a62b24f382eb44e62d995f811ba9dff18578f95d39d), so the two resolvers were pointed at one host; this is this site's own observation.
EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca — Chollima Hunter (on-chain observation) -
Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-06 (transaction 0x8dd774b7690d9542bac406d96c52f8ab0ee5d1f9c40ae077decbb618237b9309), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. It replaced rversl.centralus.cloudapp.azure.com, written two days earlier, and was itself replaced by basodara.com four days later. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x0a77e721b149eace6c7c1a62b24f382eb44e62d995f811ba9dff18578f95d39d), so the two resolvers were pointed at one host; this is this site's own observation.
Ethereum transaction 0x8dd774b7690d9542bac406d96c52f8ab0ee5d1f9c40ae077decbb618237b9309 — Chollima Hunter (on-chain observation) -
Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-06 (transaction 0x8dd774b7690d9542bac406d96c52f8ab0ee5d1f9c40ae077decbb618237b9309), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. It replaced rversl.centralus.cloudapp.azure.com, written two days earlier, and was itself replaced by basodara.com four days later. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x0a77e721b149eace6c7c1a62b24f382eb44e62d995f811ba9dff18578f95d39d), so the two resolvers were pointed at one host; this is this site's own observation.
EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig -
Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-06 (transaction 0x8dd774b7690d9542bac406d96c52f8ab0ee5d1f9c40ae077decbb618237b9309), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). An Azure cloudapp.azure.com name written by an operator of the contract, in the same pattern as other Azure-hosted EtherRAT values; the name is a free regional label and says nothing about the account behind it. It replaced rversl.centralus.cloudapp.azure.com, written two days earlier, and was itself replaced by basodara.com four days later. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x0a77e721b149eace6c7c1a62b24f382eb44e62d995f811ba9dff18578f95d39d), so the two resolvers were pointed at one host; this is this site's own observation.
Ethereum transaction 0x0a77e721b149eace6c7c1a62b24f382eb44e62d995f811ba9dff18578f95d39d — Chollima Hunter (on-chain observation)
Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.
Related indicators
Cited by the same report: EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca
All 15 indicators from this source