`0x999941b74f6bbc921d5174a5b29911562cd2d7cf`

0x999941b74f6bbc921d5174a5b29911562cd2d7cf is a smart contract address that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Unit 42 (Palo Alto Networks). The report is dated 2026-07-30.

DPRK link unconfirmed Unit 42 reports RemusStealer as commodity infostealer activity spread through SEO-poisoned warez sites and ties it to no state actor. No published source ties it to North Korea. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

smart contract address EtherHiding CURATED

First seen 2026-07-30 · last seen 2026-07-30

Source

As printed:

0x999941b74F6bbc921D5174A5b29911562cd2D7CF (smart contract queried to resolve the C2 URL)

Notes:

Ethereum contract the Remus infostealer queries through public RPC endpoints to resolve its C2 URL, in a Turkish-language fake cracked-software campaign Unit 42 reported in July 2026; Unit 42 had named the same contract in a May 2026 RemusStealer note.
Remus Info-Stealer Uses Blockchain-Anchored C2 and Fake Cracked Software Lures — Unit 42 (Palo Alto Networks) · published 2026-07-30 · pulled 2026-10-26

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.