← EtherHiding Tracker

0xc12c8d8f9706244eca0acf04e880f10ff4e52522

0xc12c8d8f9706244eca0acf04e880f10ff4e52522 is a smart contract address that 2 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Atos Threat Research Center. The reports are dated 2026-04-14.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Etherscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Show 50 more

smart contract address EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

Listed as Ethereum

First seen 2026-04-14 · last seen 2026-04-14

Sources

• As printed:

  0xc12c8d8f9706244eca0acf04e880f10ff4e52522

  Notes:

  Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-03-31 with 21 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x37ef6e88425613564b2cf8adc496acff4b6481a9) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.

  EtherRAT-appendixes (IoCs/wallets_and_contracts.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

• As printed:

  For the purpose of this explanation, we used one of the contracts used by attackers ( 0xc12c8d8f9706244eca0acf04e880f10ff4e52522) and wallet that funded it ( 0x37ef6e88425613564b2cf8adc496acff4b6481a9).

  Notes:

  Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-03-31 with 21 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x37ef6e88425613564b2cf8adc496acff4b6481a9) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.

  EtherRAT distribution: spoofing administrative tools via GitHub facades — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

• …against takedown and blocklisting efforts. For the purpose of this explanation, we used one of the contracts used by attackers ( 0xc12c8d8f9706244eca0acf04e880f10ff4e52522) and wallet that funded it ( 0x37ef6e88425613564b2cf8adc496acff4b6481a9).…

  EtherRAT distribution spoofing administrative tools via GitHub facades — Atos Threat Research Center · under “Decentralized C2 Infrastructure” · published 2026-04-14 · pulled 2026-10-03

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT-appendixes (IoCs/wallets_and_contracts.csv)

Atos Threat Research Center lists 96 other indicators in this source. 7 are shown, chosen across types.

• 91.215.85.42 IP address
• 91.221.190.12 IP address
• pwmover/Profwiz malicious repository
• pxmon/Process-Explorer malicious repository
• 0xe26c57b7fa8de030238b0a71b3d063397ac127d3 smart contract address
• 0xcaac38183d1b4ee29ddb8e7965012f26e9cd6610 cryptocurrency wallet address
• 0xd9afc5c883f45206c916d8e312c2d9f13766344d cryptocurrency wallet address

All 97 indicators from this source

Cited by the same report: EtherRAT distribution: spoofing administrative tools via GitHub facades

Atos Threat Research Center lists 44 other indicators in this source. 5 are shown, chosen across types.

• 135.125.255.55 IP address
• adkcore/Windows-ADK malicious repository
• applck/AppLocker malicious repository
• autify5/Autologon malicious repository
• 0x37ef6e88425613564b2cf8adc496acff4b6481a9 cryptocurrency wallet address

All 45 indicators from this source