`0x5ea589954314fe8d5ecb509b35d77a389912b42f`

0x5ea589954314fe8d5ecb509b35d77a389912b42f is a smart contract address that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from LevelBlue. The report is dated 2026-10-07.

DPRK link unconfirmed LevelBlue SpiderLabs ties this to the PhantomPolia loader, which delivers Remus Stealer through ClickFix lures, and names no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`voidravenstorm.top`		Malicious				2026-06-05	reported

smart contract address EtherHiding CURATED

First seen 2026-10-07 · last seen 2026-10-07

Source

As printed:

0x5eA589954314Fe8D5eCB509b35D77a389912B42F

Notes:

Ethereum Sepolia testnet contract the PhantomPolia loader reads as a dead-drop resolver: it calls getText() (selector 0xe00fe2eb) over public Sepolia RPC endpoints and decrypts the value, PBKDF2-SHA256 with a hardcoded password and AES-GCM, to its C2 domain, which LevelBlue SpiderLabs reports as voidravenstorm.top. The loader delivers Remus Stealer, which the report links to the Lumma family. Deployed on 2026-06-06 by 0x92f3f39c1cde5ee705820af022e2b85c4eaa43f6, and never rewritten; this site decrypted the stored value with the published password on 2026-10-12 and got voidravenstorm.top.
Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign — LevelBlue · published 2026-10-07 · pulled 2026-10-12

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: Inside PhantomPolia: Remus Stealer Delivery via Donut Shellcode in ClickFix Campaign

LevelBlue lists 40 other indicators in this source. 12 are shown, chosen across types.

All 41 indicators from this source