← EtherHiding Tracker

193.32.162.52

193.32.162.52 is an IP address that 2 published sources report in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and Ransom-ISAC. The earliest of those reports is dated 2026-09-25 and the most recent 2026-10-02.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

ip address EtherHiding / UNC5342Contagious Interview CURATED

First seen 2026-09-25 · last seen 2026-10-02

Network

Looked up 2026-10-04 at ip-api.com. A hosting range is not evidence on its own.

Sources

• Command-and-control IP decoded from the recipient address 0xc120a23401bbc120a234005000ff73f5fdce576f, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 began paying on 2026-10-02. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, 01bb or 443, with the same IP repeated as the secondary endpoint. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.

  Ethereum transaction 0x511dc9b8a0185a76cf0becd119a22978bf190f007c64ac85775ad6f97604a826 — Chollima Hunter (on-chain observation) · published 2026-10-02 · pulled 2026-10-04

• Command-and-control IP decoded from the recipient address 0xc120a23401bbc120a234005000ff73f5fdce576f, which the watchlisted XCTDH signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 began paying on 2026-10-02. Read with the encoding Ransom-ISAC published for this wallet: the first four bytes are the IP and the next two the port, 01bb or 443, with the same IP repeated as the secondary endpoint. This is an on-chain observation by this site, made after the report was published, and it is recorded as the address the implant is pointed at, not as a host this site has observed serving anything.

  XCTDH Adopts Hash Hiding — Ransom-ISAC · published 2026-09-25 · pulled 2026-10-04

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 19 other indicators in this source. 12 are shown, chosen across types.

• 103.213.248.45 IP address
• 2.56.123.203 IP address
• 89.19.222.25 IP address
• 95.135.181.15 IP address
• 95.135.181.25 IP address
• 0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22 transaction hash
• 0x84e8cecd5b077eef530e7d69d546e2555199cb61759d1224d31cb31750788f62 transaction hash
• 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb cryptocurrency wallet address
• 0x9d202c824402ca89e9aaccd2390b6f8b332ae743caa1469c695feb2781d56519 cryptocurrency wallet address
• 0xb5d6959301bbb5d69593005000ffaba8a5a2ada2 cryptocurrency wallet address
• TCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF cryptocurrency wallet address
• TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH cryptocurrency wallet address

All 20 indicators from this source