154.91.0.20
154.91.0.20 is an IP address
that 4 published sources report
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Ransom-ISAC.
The earliest of those reports is dated 2026-09-25 and the most recent 2026-10-11.
On-chain links
| Address | Transaction | Type | Role | Malware family | First written | Last written |
|---|---|---|---|---|---|---|
0x596dcc9fda875309ff85eba09cf5a97d8c7691bb |
BscScan | Wallet, ethereum | resolver wallet | DEV#POPPER.js | 2026-10-06 | 2026-10-20 |
ip address EtherHiding / UNC5342Contagious Interview CURATED
Network
| Kind | fixed line |
|---|---|
| Network | Evoxt Enterprise |
| Announced by | AS149440 Evoxt Sdn. Bhd. |
| Country | United Kingdom |
Sources
-
Command-and-control address, on port 443, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything.
BNB Smart Chain transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 — Chollima Hunter (on-chain observation) -
Command-and-control address, on port 443, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything.
BNB Smart Chain transaction 0x54faddb547cf8b608758f4c2ccd89b48f4262e63168348a60e3e14f5fa465a0a — Chollima Hunter (on-chain observation) -
Command-and-control address, on port 443, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything.
Ethereum transaction 0x1a0ecab889fcf804a2f7dd23f7b3e530690d62ee5d4854f67388b948be402eb9 — Chollima Hunter (on-chain observation) -
Command-and-control address, on port 443, named in the remote-access stage the XCTDH signal address 0x596dcc9fda875309ff85eba09cf5a97d8c7691bb has pointed implants at since 2026-10-06. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Every version of that stage written from 2026-10-06 to the current one, BSC transaction 0x674c3adb5d9a9d64ddda8f89b4f413008888b254eecd763780123223fb5b9ac6 of 2026-10-08, names 154.91.0.20:443 and 166.0.106.182 as its servers. Decoded statically by this site on 2026-10-11 by reimplementing each layer's transform; recorded as the address the implant is pointed at, not as a host this site has observed serving anything.
XCTDH Adopts Hash Hiding — Ransom-ISAC
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.