← EtherHiding Tracker

01fd153bfb4be440dd46cea7bebe8eb61b1897596523f6f6d1a507a708b17cc7

01fd153bfb4be440dd46cea7bebe8eb61b1897596523f6f6d1a507a708b17cc7 is a file hash that one published source reports in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Google Threat Intelligence Group. The report is dated 2025-10-16.

file hash EtherHiding / UNC5342Contagious Interview CURATED

Listed as 01fd153bfb4b...

First seen 2025-10-16 · last seen 2025-10-16

Sources

• As printed:

  01fd153bfb4be440dd46cea7bebe8eb61b1897596523f6f6d1a507a708b17cc7

  Notes:

  SHA-256 of the JADESNOW JavaScript downloader sample GTIG lists as launching the infection chain. This is the file the G_Downloader_JADESNOW_1 YARA rule in this watchlist is written to match, so a hash hit and a rule hit on the same file corroborate each other.

  DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-08-30

• …SHA256 Hash (Initial JavaScript Downloader) 01fd153bfb4be440dd46cea7bebe8eb61b1897596523f6f6d1a507a708b17cc7 JADESNOW sample to launch infection chain.…

  DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains | Google Cloud Blog — Google Threat Intelligence Group · under “Indicators of Compromise” · published 2025-10-16 · pulled 2026-09-12

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 12 are shown, chosen across types.

• 970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628 file hash
• 154.91.0.103 IP address
• 23.27.20.143 IP address
• 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c smart contract address
• 0x9bc1355344b54dedf3e44296916ed15653844509 smart contract address
• 0x0493601b42ce82e7243d518f4a0eb090dcf39ec52bfbfe52cd25811e61114540 transaction hash
• 0x0f705fd19dddd0136bb850eb2f5753c8ee13f8aa9aec57e2d809684352cc7347 transaction hash
• 0x1f62d5c5a93726cbf341715f921d6d947b6d076742eaab1883a6973d06ee148d transaction hash
• 0x24622144ea31a93e38ae727792da8a016377f1c3d55fe5d6d51dcefd1aaee29b transaction hash
• 0x5c77567fcf00c317b8156df8e00838105f16fdd4fbbc6cd83d624225397d8856 transaction hash
• 0x86d1a21fd151e344ccc0778fd018c281db9d40b6ccd4bdd3588cb40fade1a33a transaction hash
• 0x8d31cc22ceb128ea1b70704f9cfdf2f87a60dac547101623e02c22ff014241a9 transaction hash

All 17 indicators from this source