`193.247.144.38`

193.247.144.38 is an IP address that 7 published sources report in connection with EtherHiding / UNC5342, NullReceiver, Contagious Interview, unclustered DPRK and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation), OpenSourceMalware, Isotope13, Socket, SlowMist, SafeDep and BlueCyber. The earliest of those reports is dated 2026-08-02 and the most recent 2026-10-18.

On-chain links

EtherHiding addresses that pointed malware at this host, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. See the EtherHiding Tracker.

Address	Transaction	Type	Role	Malware family	First written	Last written
`0xa322e5f3d311d3080e6f0121063e9adc2490ef1a`	Etherscan	Wallet, ethereum	resolver wallet	NullReceiver	2026-09-04	2026-10-13
`0xc1f79026c1f7902668656c6c6f6970626f742121`	Etherscan	Wallet, ethereum		NullReceiver	2026-09-04	2026-10-13

ip address EtherHiding / UNC5342NullReceiverContagious InterviewDPRK (cluster unattributed)PolinRider CURATED

First seen 2026-08-02 · last seen 2026-10-18

Network

Kind	fixed line
Network	Evoxt Enterprise (Jerng Yue Lee trading as Evoxt Enterprise)
Announced by	AS149440 Evoxt Sdn. Bhd.
Country	United Kingdom

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Sources

Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to between 2026-09-04 and 2026-09-17. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It is the first destination in this series to fall outside 166.88.0.0/16, the range the reported address and two of the three this site has observed all sit in.
Ethereum transaction 0xe087ecadb59b0ce61b5bce89870a82f612935e7b19be018bfa3e5c6bfa6efe58 — Chollima Hunter (on-chain observation) · published 2026-09-04 · pulled 2026-09-20
Command-and-control IP decoded from the NullReceiver destination address that the watchlisted resolver wallet pointed to between 2026-09-04 and 2026-09-17. This is an on-chain observation by this site, not a value carried in published reporting. It is recorded as the address the malware resolves to, not as a host this site has observed serving anything; the transaction that carries it is on-chain and public, while what the IP was doing at any given moment is not. It is the first destination in this series to fall outside 166.88.0.0/16, the range the reported address and two of the three this site has observed all sit in.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-09-20
…has been publishing an address every 15 minutes or so since late July, rotating through 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , and 193.247.144.38 .…
BindsNET repository carried a forged merge commit that ran malware on folder open — Isotope13 · under “BindsNET repository carried a forged merge commit that ran malware on folder open” · published 2026-08-29 · pulled 2026-09-12
…Dead-Drop Resolver Ethereum Sender Address # 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files # 7d47c430e6e404dc2fa8b4837678d1cbdb4d0aeacec9b405655cab79d54a2ad9 -…
PolinRider Spreads Through Compromised GitHub Accounts and Packagist | Socket — Socket · under “Resolved C2 IP Addresses #” · published 2026-09-17 · pulled 2026-09-29
…The most recent five cycles corresponded to 166.88.134.62, 23.27.13.135, 166.88.73.46, 193.247.144.38, and the current round's 166.88.134.75, respectively. Press enter or click to view image in full size After the address is…
PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager — SlowMist · under “From a Single Line of Configuration to On-Chain Resolution” · published 2026-09-21 · pulled 2026-10-01
…to 2026-08-22 166.88.134.62 2026-08-22 to 2026-08-27 23.27.13.135 2026-08-28 to 2026-09-03 166.88.73.46 2026-09-04 to 2026-09-17 193.247.144.38 2026-09-17 to 2026-09-28 166.88.134.75 2026-09-28 to 2026-09-30 91.218.183.174 The first server, 166.88.134.62 , is the server…
PolinRider Switches to Ethereum C2 in 30+ Repositories — SafeDep · under “The second Ethereum wallet” · published 2026-09-30 · pulled 2026-10-02
…, npmuser3002 Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh: A10-npm3! , helloipbot!! 7.6.…
EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C — BlueCyber · under “7.5. IoC” · published 2026-10-18 · pulled 2026-10-26

Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.

Related indicators

Cited by the same report: Ethereum transaction 0xe087ecadb59b0ce61b5bce89870a82f612935e7b19be018bfa3e5c6bfa6efe58

Chollima Hunter (on-chain observation) lists 1 other indicator in this source.

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 6 are shown, chosen across types.

All 16 indicators from this source

Cited by the same report: BindsNET repository carried a forged merge commit that ran malware on folder open

Isotope13 lists 1 other indicator in this source.