`0x2aca749b59529f5cbcd6fbd34b35b1a546713df6`

0x2aca749b59529f5cbcd6fbd34b35b1a546713df6 is a smart contract address that one published source reports in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cyber Security News. The report is dated 2026-07-31.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`rg-telemetry.sbs`		Malicious				2026-06-10	2026-06-13	2026-06-13

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Etherscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-06-13	`0x7341593570c6…`	`0x30b373c50f0d…`	`0x0e96ed1bcb9abadba2527d4770378b86720b1b13213455c7521f1a7ebbc9660fa3eeceabd16852680250a6e28877aef7dfafd02b53341244a4f79d72`

smart contract address EtherHiding / UNC5342Contagious Interview CURATED

First seen 2026-07-31 · last seen 2026-07-31

Source

As printed:

Ethereum contract 0x2acA749b59529f5CBCd6fbd34B35b1A546713dF6 EtherHiding contract for backdoor configuration

Notes:

Ethereum contract the report lists as holding the configuration for the Node.js backdoor stage of a ClickFix-delivered chain. The report describes the backdoor resolving its command-and-control location by reading this contract rather than from a hard-coded address, which is the EtherHiding pattern: the operator rewrites the stored value instead of re-deploying the malware. Transcribed from the report's own indicator table. Unlike the entries on this page drawn from contracts this site read directly, nothing here has been verified on-chain: the checker could not reach an RPC endpoint from where this was recorded, and a failed query is recorded as failed rather than filled in. Treat it as the report's claim until checked.
North Korean EtherHiding Campaign Targets Crypto Wallets and Developer Credentials — Cyber Security News · published 2026-07-31 · pulled 2026-09-09

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: North Korean EtherHiding Campaign Targets Crypto Wallets and Developer Credentials

Cyber Security News lists 10 other indicators in this source.