Chollima Hunter

← EtherHiding Tracker

j9af4sr.guru

j9af4sr.guru is a domain that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Prophet Security. The report is dated 2026-07-22.

DPRK link unconfirmed Prophet Security says only that the initial access matches publicly reported Contagious Interview activity, at moderate confidence, and names no actor. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

AddressTransactionTypeRoleMalware familyFirst writtenLast written
0x363aeaf1f67f1fb7abddc3f9806a301f1c64abe3 Wallet, polygon owner wallet reported
0xa3a603f8a454a9c905b4c579bb72628f7c15c2a0 Contract, polygon reported

domain EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-07-22 · last seen 2026-07-22

Registration

Registered2026-06-30
RegistrarGlobal Domain Group LLC
Expires2027-06-30
Last changed2026-08-13
Statusclient transfer prohibited

From the registry’s RDAP record for j9af4sr.guru, looked up 2026-10-11.

Source

  • As printed:

    j9af4sr[.]guru

    Notes:

    Command-and-control domain the Polygon EtherHiding contract 0xa3a603f8a454a9c905b4c579bb72628f7c15c2a0 served to a macOS implant, from Prophet Security's list of domains read from the contract's writes since 2026-05-18.
    EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain — Prophet Security · published 2026-07-22 · pulled 2026-10-11

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain

Prophet Security lists 12 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.