← EtherHiding Tracker

95.135.181.25

95.135.181.25 is an IP address that 3 published sources report in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and Ransom-ISAC. The earliest of those reports is dated 2026-09-25 and the most recent 2026-11-02.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

ip address EtherHiding / UNC5342Contagious Interview CURATED

First seen 2026-09-25 · last seen 2026-11-02

Network

Looked up 2026-10-26 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

• Command-and-control address named in the remote-access and dropper stages the signal address pointed at on 2026-10-21. The XCTDH loader reads the recipient of each transaction from 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb as packed pointers to BNB Smart Chain transactions, whose inputs carry XOR-encrypted scripts; this site follows the pointers and decodes each stage statically, without running it. From 2026-11-02 the first signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 also points implants straight at it, through the recipient address 0x5f87b51900505f87b519005000ffeecb20ccec7c (port 80), read with the encoding Ransom-ISAC published for that wallet; it was still doing so on 2026-11-11. Recorded as the address the implant is pointed at, not as a host this site has observed serving anything.

  BNB Smart Chain transaction 0x51c6d8261eede4748a167c1afcf7f859e4aeedc001a4b84f93d2664aa5f9c8df — Chollima Hunter (on-chain observation) · published 2026-10-21 · pulled 2026-10-26

• Command-and-control address named in the remote-access and dropper stages the signal address pointed at on 2026-10-21. The XCTDH loader reads the recipient of each transaction from 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb as packed pointers to BNB Smart Chain transactions, whose inputs carry XOR-encrypted scripts; this site follows the pointers and decodes each stage statically, without running it. From 2026-11-02 the first signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 also points implants straight at it, through the recipient address 0x5f87b51900505f87b519005000ffeecb20ccec7c (port 80), read with the encoding Ransom-ISAC published for that wallet; it was still doing so on 2026-11-11. Recorded as the address the implant is pointed at, not as a host this site has observed serving anything.

  XCTDH Adopts Hash Hiding — Ransom-ISAC · published 2026-09-25 · pulled 2026-10-26

• Command-and-control address named in the remote-access and dropper stages the signal address pointed at on 2026-10-21. The XCTDH loader reads the recipient of each transaction from 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb as packed pointers to BNB Smart Chain transactions, whose inputs carry XOR-encrypted scripts; this site follows the pointers and decodes each stage statically, without running it. From 2026-11-02 the first signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 also points implants straight at it, through the recipient address 0x5f87b51900505f87b519005000ffeecb20ccec7c (port 80), read with the encoding Ransom-ISAC published for that wallet; it was still doing so on 2026-11-11. Recorded as the address the implant is pointed at, not as a host this site has observed serving anything.

  Ethereum transaction 0xa43ac0c1dae0299bef55f036052af716f34c25dba9b062e6a4e626af54d47b31 — Chollima Hunter (on-chain observation) · published 2026-11-02 · pulled 2026-10-26

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 19 other indicators in this source. 12 are shown, chosen across types.

• 103.213.248.45 IP address
• 111.90.143.39 IP address
• 136.0.7.231 IP address
• 150.40.98.42 IP address
• 193.32.162.52 IP address
• 0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22 transaction hash
• 0x84e8cecd5b077eef530e7d69d546e2555199cb61759d1224d31cb31750788f62 transaction hash
• 0x171b14bb0050171b14bb01bb398eaab6441fbd47 cryptocurrency wallet address
• 0x171b14bb01bb171b14bb0050eb7f39c35c47e682 cryptocurrency wallet address
• 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 cryptocurrency wallet address
• 0x3d2075f97b7b1e3234bd653779d21c605d7d8c6ec9c98d983880be5c7f4f9471 cryptocurrency wallet address
• TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH cryptocurrency wallet address

All 20 indicators from this source