154.91.0.103
154.91.0.103 is an IP address
that 7 published sources report
in connection with EtherHiding / UNC5342, Contagious Interview, PolinRider and Lazarus Group activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation), Google Threat Intelligence Group, OpenSourceMalware and Ransom-ISAC.
The earliest of those reports is dated 2025-10-16 and the most recent 2026-10-30.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0x8eac3198dd72f3e07108c4c7cff43108ad48a71c |
BscScan | Contract, bsc | JADESNOW | 2025-02-19 | 2025-02-19 | |
0x9bc1355344b54dedf3e44296916ed15653844509 |
BscScan | Contract, bsc | owner wallet | JADESNOW | 2025-02-19 | 2025-02-19 |
ip address EtherHiding / UNC5342Contagious InterviewPolinRiderLazarus Group CURATED
Network
| Kind | fixed line |
|---|---|
| Network | Evoxt Enterprise |
| Announced by | AS149440 Evoxt Sdn. Bhd. |
| Country | United Kingdom |
Sources
-
Command-and-control host served by the watchlisted BNB Smart Chain dead drop 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c during 19 February 2025. This site recovered it by reading the contract's stored payload from archive state at the blocks where it changed. Across that window the contract held short strings rather than a script, each a URL wrapped in ".." delimiters and encoded as reversed base64; reversing and decoding gives http://154.91.0.103, http://154.91.0.103:27017, http://154.91.0.103:1433, http://154.91.0.103:5432. The ports are database services, which is where this toolset sends what it collects. Recorded as an address the malware was pointed at, not as a host this site has observed serving anything. Two of the four writes spell the address with zero padding, as 154.91.000.103.
BNB Smart Chain transaction 0x3f07629e169a50e23ed6aa4b8e5976aa165d0102e687cb623e3bacf7b910cf28 — Chollima Hunter (on-chain observation) -
Command-and-control host served by the watchlisted BNB Smart Chain dead drop 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c during 19 February 2025. This site recovered it by reading the contract's stored payload from archive state at the blocks where it changed. Across that window the contract held short strings rather than a script, each a URL wrapped in ".." delimiters and encoded as reversed base64; reversing and decoding gives http://154.91.0.103, http://154.91.0.103:27017, http://154.91.0.103:1433, http://154.91.0.103:5432. The ports are database services, which is where this toolset sends what it collects. Recorded as an address the malware was pointed at, not as a host this site has observed serving anything. Two of the four writes spell the address with zero padding, as 154.91.000.103.
BNB Smart Chain transaction 0xbb25aef4e375bda478ac31cc3ce21f8da232aefa13bc1b0110c27a4a33287c59 — Chollima Hunter (on-chain observation) -
Command-and-control host served by the watchlisted BNB Smart Chain dead drop 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c during 19 February 2025. This site recovered it by reading the contract's stored payload from archive state at the blocks where it changed. Across that window the contract held short strings rather than a script, each a URL wrapped in ".." delimiters and encoded as reversed base64; reversing and decoding gives http://154.91.0.103, http://154.91.0.103:27017, http://154.91.0.103:1433, http://154.91.0.103:5432. The ports are database services, which is where this toolset sends what it collects. Recorded as an address the malware was pointed at, not as a host this site has observed serving anything. Two of the four writes spell the address with zero padding, as 154.91.000.103.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group -
…IPs worth an interim block at the firewall level while you work through remediation: 166.88.54.158 , 198.105.127.210 , 23.27.202.27 , 154.91.0.103 , 136.0.9.8 , 166.88.4.2 , 23.27.120.142 , 202.155.8.173 , 166.88.134.82 , 188.43.33.249 , 23.27.13.43 .…
A Developer's Guide to Getting Rid of PolinRider | OpenSourceMalware — OpenSourceMalware -
…Evoxt Enterprise Sep 2025 ACTIVE 27017 Cluster-1 HIGH 23.27.120.142 149440 Evoxt Enterprise Oct 2025 ACTIVE 27017 Cluster-1 HIGH 154.91.0.103 149440 Evoxt Enterprise Feb 2025 Mar 2025 27017 , 5432, 1433 Cluster-2 MEDIUM 85.239.62.36 62240 Clouvider Limited May 2025 June 2025…
Cross-Chain TxDataHiding Crypto Heist: A Very Chainful Process (Part 1) — Ransom-ISAC -
…different and an interesting string is left behind, BEP-20: BOT250205 (BOT) : C2 Stager in XCTDH Case Field Value C2 IP 154.91.0.103 C2 Port 27017 (0x6989) Full C2 URL http://154.91.0.103:27017/$/boot XOR Key ThZG+0jfXE6VAGOJ User-Agent Mozilla/5.0 (Windows NT…
Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC -
…dead drop TRON first, with Aptos and BNB Smart Chain as fallbacks BNB Smart Chain, then Ethereum calldata Command server 154.91.0.103 The bootstrapper’s server Server paths /verify-human/{channel} , /u/f , /d/python.zip , /d/python.7z , /d/7zr.exe All five appear in…
Earliest Known PolinRider Malware Found in 2025 npm Packages | OpenSourceMalware — OpenSourceMalware
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.