166.0.106.182
166.0.106.182 is an IP address
that 6 published sources report
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Ransom-ISAC.
The earliest of those reports is dated 2026-09-25 and the most recent 2026-10-12.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0x596dcc9fda875309ff85eba09cf5a97d8c7691bb |
BscScan | Wallet, ethereum | resolver wallet | DEV#POPPER.js | 2026-10-06 | 2026-10-20 |
ip address EtherHiding / UNC5342Contagious Interview CURATED
Network
| Kind | data centre |
|---|---|
| Network | Ace Data Centers |
| Announced by | AS149440 Evoxt Sdn. Bhd. |
| Country | Canada |
| Flags | hosting range |
Sources
-
Command-and-control address, on port 80, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything. The chain's third script, BSC transaction 0xea0650c1317c4db2a4f1a62a48fd472660855d3d7e62020f4932d85b64e43926 of 2026-10-06 (obfuscator.io output with RC4-encoded strings, decoded statically by this site on 2026-10-11), names the same host over plain HTTP: a Node.js dropper that posts host details to /snv and logs to /verify-human/{id}, fetches a Windows Python runtime from /d/, and runs a Python stage served from /$/{id}. Its replacement, BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 of 2026-10-12 (decoded statically by this site the same day), names the same host and posts to /u/snv, fetching /d/7zr.exe and /d/python.7z.
BNB Smart Chain transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 — Chollima Hunter (on-chain observation) -
Command-and-control address, on port 80, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything. The chain's third script, BSC transaction 0xea0650c1317c4db2a4f1a62a48fd472660855d3d7e62020f4932d85b64e43926 of 2026-10-06 (obfuscator.io output with RC4-encoded strings, decoded statically by this site on 2026-10-11), names the same host over plain HTTP: a Node.js dropper that posts host details to /snv and logs to /verify-human/{id}, fetches a Windows Python runtime from /d/, and runs a Python stage served from /$/{id}. Its replacement, BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 of 2026-10-12 (decoded statically by this site the same day), names the same host and posts to /u/snv, fetching /d/7zr.exe and /d/python.7z.
BNB Smart Chain transaction 0x54faddb547cf8b608758f4c2ccd89b48f4262e63168348a60e3e14f5fa465a0a — Chollima Hunter (on-chain observation) -
Command-and-control address, on port 80, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything. The chain's third script, BSC transaction 0xea0650c1317c4db2a4f1a62a48fd472660855d3d7e62020f4932d85b64e43926 of 2026-10-06 (obfuscator.io output with RC4-encoded strings, decoded statically by this site on 2026-10-11), names the same host over plain HTTP: a Node.js dropper that posts host details to /snv and logs to /verify-human/{id}, fetches a Windows Python runtime from /d/, and runs a Python stage served from /$/{id}. Its replacement, BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 of 2026-10-12 (decoded statically by this site the same day), names the same host and posts to /u/snv, fetching /d/7zr.exe and /d/python.7z.
Ethereum transaction 0x1a0ecab889fcf804a2f7dd23f7b3e530690d62ee5d4854f67388b948be402eb9 — Chollima Hunter (on-chain observation) -
Command-and-control address, on port 80, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything. The chain's third script, BSC transaction 0xea0650c1317c4db2a4f1a62a48fd472660855d3d7e62020f4932d85b64e43926 of 2026-10-06 (obfuscator.io output with RC4-encoded strings, decoded statically by this site on 2026-10-11), names the same host over plain HTTP: a Node.js dropper that posts host details to /snv and logs to /verify-human/{id}, fetches a Windows Python runtime from /d/, and runs a Python stage served from /$/{id}. Its replacement, BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 of 2026-10-12 (decoded statically by this site the same day), names the same host and posts to /u/snv, fetching /d/7zr.exe and /d/python.7z.
XCTDH Adopts Hash Hiding — Ransom-ISAC -
Command-and-control address, on port 80, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything. The chain's third script, BSC transaction 0xea0650c1317c4db2a4f1a62a48fd472660855d3d7e62020f4932d85b64e43926 of 2026-10-06 (obfuscator.io output with RC4-encoded strings, decoded statically by this site on 2026-10-11), names the same host over plain HTTP: a Node.js dropper that posts host details to /snv and logs to /verify-human/{id}, fetches a Windows Python runtime from /d/, and runs a Python stage served from /$/{id}. Its replacement, BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 of 2026-10-12 (decoded statically by this site the same day), names the same host and posts to /u/snv, fetching /d/7zr.exe and /d/python.7z.
BNB Smart Chain transaction 0xea0650c1317c4db2a4f1a62a48fd472660855d3d7e62020f4932d85b64e43926 — Chollima Hunter (on-chain observation) -
Command-and-control address, on port 80, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything. The chain's third script, BSC transaction 0xea0650c1317c4db2a4f1a62a48fd472660855d3d7e62020f4932d85b64e43926 of 2026-10-06 (obfuscator.io output with RC4-encoded strings, decoded statically by this site on 2026-10-11), names the same host over plain HTTP: a Node.js dropper that posts host details to /snv and logs to /verify-human/{id}, fetches a Windows Python runtime from /d/, and runs a Python stage served from /$/{id}. Its replacement, BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 of 2026-10-12 (decoded statically by this site the same day), names the same host and posts to /u/snv, fetching /d/7zr.exe and /d/python.7z.
BNB Smart Chain transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 — Chollima Hunter (on-chain observation)
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.