← EtherHiding Tracker

basodara.com

basodara.com is a domain that 4 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and Sysdig. The reports are dated 2026-11-10.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

domain EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-11-10 · last seen 2026-11-10

Registration

From the registry’s RDAP record for basodara.com, looked up 2026-11-12.

Sources

• Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-10 (transaction 0xe1ee6e2e468df06f4120bd504526840a9de2ab14a4b097f1469cd0824925c8dc), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-11-10, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no, 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. It was the contract's value when this site read it on 2026-11-11. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x895edb53c404673fff4a141536b0f5b6e76af6dfd3ceeb8b578da2c135eece74), so the two resolvers were pointed at one host; this is this site's own observation.

  EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca — Chollima Hunter (on-chain observation) · published 2026-11-10 · pulled 2026-11-11

• Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-10 (transaction 0xe1ee6e2e468df06f4120bd504526840a9de2ab14a4b097f1469cd0824925c8dc), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-11-10, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no, 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. It was the contract's value when this site read it on 2026-11-11. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x895edb53c404673fff4a141536b0f5b6e76af6dfd3ceeb8b578da2c135eece74), so the two resolvers were pointed at one host; this is this site's own observation.

  Ethereum transaction 0xe1ee6e2e468df06f4120bd504526840a9de2ab14a4b097f1469cd0824925c8dc — Chollima Hunter (on-chain observation) · published 2026-11-10 · pulled 2026-11-11

• Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-10 (transaction 0xe1ee6e2e468df06f4120bd504526840a9de2ab14a4b097f1469cd0824925c8dc), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-11-10, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no, 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. It was the contract's value when this site read it on 2026-11-11. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x895edb53c404673fff4a141536b0f5b6e76af6dfd3ceeb8b578da2c135eece74), so the two resolvers were pointed at one host; this is this site's own observation.

  EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks — Sysdig · pulled 2026-11-11

• Value written to the EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca by operator wallet 0xa001d3863b138ed523f255f62725ab1ddc82af87 on 2026-11-10 (transaction 0xe1ee6e2e468df06f4120bd504526840a9de2ab14a4b097f1469cd0824925c8dc), as recorded in the contract's setString events. This is an on-chain observation by this site, not a value carried in published reporting. The contract was found by its identical bytecode and setString event to published EtherRAT resolvers (keccak256 of runtime code 484c7fb94d7084807bf4385d4c7fe9bd768ecb92669c162fac9ab299b28f302e). RDAP shows the domain registered on 2026-11-10, the day it was written, through Tucows Domains Inc. with nameservers 1-you.njalla.no, 2-can.njalla.in and 3-get.njalla.fo, the Njalla privacy-registrar pattern that other EtherRAT operator domains share. It was the contract's value when this site read it on 2026-11-11. The label rests on Sysdig's attribution of the EtherRAT family; one deployment of the family (The DFIR Report) ended in The Gentlemen ransomware with no nation-state named, so this entry carries low confidence and is not itself a DPRK attribution. The same value was written on the same day to 0x788a5336c0ef70be87619a3c13a43050c426f7ec, the resolver of the EtherRAT fake Microsoft Teams campaign, by its resolver address 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f (transaction 0x895edb53c404673fff4a141536b0f5b6e76af6dfd3ceeb8b578da2c135eece74), so the two resolvers were pointed at one host; this is this site's own observation.

  Ethereum transaction 0x895edb53c404673fff4a141536b0f5b6e76af6dfd3ceeb8b578da2c135eece74 — Chollima Hunter (on-chain observation) · published 2026-11-10 · pulled 2026-11-11

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: EtherRAT resolver contract 0x45729d7424d7310a0c041a2906ba95a4bd5ebfca

Chollima Hunter (on-chain observation) lists 14 other indicators in this source. 7 are shown, chosen across types.

• bdstop.net domain
• bermanlawrsk.com domain
• chjunhao.com domain
• dmors.com domain
• ianbelknap.com domain
• isocell.swedencentral.cloudapp.azure.com domain
• labipt.com domain

All 15 indicators from this source

Cited by the same report: EtherRAT: DPRK uses novel Ethereum implant in React2Shell attacks

Sysdig lists 56 other indicators in this source. 5 are shown, chosen across types.

• 193.24.123.68 IP address
• 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 smart contract address
• 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 smart contract address
• 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 smart contract address
• 0xe941a9b283006f5163ee6b01c1f23aa5951c4c8d cryptocurrency wallet address

All 57 indicators from this source