`0xb3f2897f2bc797e5b9033faef8c81e92b01cb831`

0xb3f2897f2bc797e5b9033faef8c81e92b01cb831 is a smart contract address that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Hunt.io. The report is dated 2026-08-04.

DPRK link unconfirmed Hunt.io ties this infrastructure to an affiliate of The Gentlemen ransomware operation, not to North Korea; it repeats Sysdig's assessment that EtherRAT is DPRK malware and says it has not verified it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Registered	First written	Last written
`itemrange.com`	Etherscan	Malicious	2026-07-01	2026-07-01	2026-07-01
`wiselystarting.com`	Etherscan	Malicious	2026-06-18	2026-06-18	2026-06-18
`simultaneouslypower.com`	Etherscan	Malicious	2026-06-12	2026-06-12	2026-06-12
`resumeacceptable.com`	Etherscan	Malicious	2026-03-31	2026-04-28	2026-04-28
`publisherresolution.com`	Etherscan	Malicious	2026-03-31	2026-04-01	2026-04-01

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Etherscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-07-01	`0xc17ab2a01edc…`	`0x40b57c3622c1…`	`https://itemrange.com`
2026-06-18	`0x03d0fb9eec50…`	`0x40b57c3622c1…`	`https://wiselystarting.com`
2026-06-12	`0xdf0164f49934…`	`0x40b57c3622c1…`	`https://simultaneouslypower.com`
2026-04-28	`0x27c92ed4f6da…`	`0x40b57c3622c1…`	`https://resumeacceptable.com`
2026-04-01	`0x025f02bf5ed8…`	`0x40b57c3622c1…`	`https://publisherresolution.com`

smart contract address EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-08-04 · last seen 2026-08-04

Source

As printed:

Ethereum contract: 0xb3f2897f2bc797e5b9033faef8c81e92b01cb831

Notes:

Ethereum contract an EtherRAT sample reads for its command-and-control server, with the lookup key 0x40b57c3622c1CbfD699207F71F2dE5A8Fe256893 hardcoded in the sample. Hunt.io lists five C2 domains the contract returned from 2026-04-01 to 2026-07-01; the first, publisherresolution.com, is also the value the watchlisted EtherRAT contract 0x8b12e09abb2e5130310b24c75b51c8afd85e8223 served.
The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2 — Hunt.io · published 2026-08-04 · pulled 2026-10-11

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

Hunt.io lists 6 other indicators in this source.