`0xf4852d108394a87c5a595d522683be586cf0cb4f`

0xf4852d108394a87c5a595d522683be586cf0cb4f is a smart contract address that 2 published sources report in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and The DFIR Report. The earliest of those reports is dated 2026-09-16 and the most recent 2026-10-12.

DPRK link unconfirmed The DFIR Report names SectopRAT (ArechClient2), commodity malware, and attributes this activity to no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from BscScan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-09-16	`0xfa358a75b8cc…`	`0xe6975e145132…`	`STARTCEV8vvO0feYvrr4SK+HGtVaKWeBfaHvOGdLkMDMKuew=FINISH`
2025-12-17	`0x9ee9aaeb4fff…`	`0xe6975e145132…`	`STARTqK7Y4UdIPCHFygHYuTbLdK8MsxjooJct1NN9+NnyZ18=FINISH`
2025-12-08	`0xd70c632ac05c…`	`0xe6975e145132…`	`STARTj3uOilASxa+ljfNGHrKrQW+MJwAyDZDJEcn8qpinR5E=FINISH`
2025-09-26	`0x8fe2c0b4c07a…`	`0xe6975e145132…`	`STARTzo0Bk31eI7jcAU+ICInWv2ZlzOyMgIyKfaiuL7UWMBE=FINISH`
2025-09-15	`0x9bbe7cbde20f…`	`0xe6975e145132…`	`START6citGUNrk+Bs8Gw6chx6Vbbeu9M1MUAazo5Gi1EhpA0=FINISH`

smart contract address EtherHiding CURATED

First seen 2026-09-16 · last seen 2026-10-12

Sources

BNB Smart Chain contract deployed by 0xe6975e14513283a5161ca883437a4e4b7298f1ca, the wallet that wrote the SectopRAT configuration contract 0xb11613acf39ad3b4dde427c27068d278fafa8998, and written 5 time(s) from 2025-09-15 to 2026-09-16 through the same function (0x3d7403a3) with the same 55-character encrypted string between START and FINISH markers. The values were not decrypted. Found by this site's EtherHiding hunt on 2026-10-12; that it serves SectopRAT rests on the shared writer and format, not on a report.
BNB Smart Chain transaction 0xfa358a75b8cc49e1231e023f5378550aea8daa765693d0baacb88aa10af70b5d — Chollima Hunter (on-chain observation) · published 2026-09-16 · pulled 2026-10-12
As printed:

0xb11613acf39ad3b4dde427c27068d278fafa8998

Notes:

BNB Smart Chain contract deployed by 0xe6975e14513283a5161ca883437a4e4b7298f1ca, the wallet that wrote the SectopRAT configuration contract 0xb11613acf39ad3b4dde427c27068d278fafa8998, and written 5 time(s) from 2025-09-15 to 2026-09-16 through the same function (0x3d7403a3) with the same 55-character encrypted string between START and FINISH markers. The values were not decrypted. Found by this site's EtherHiding hunt on 2026-10-12; that it serves SectopRAT rests on the shared writer and format, not on a report.
SectopRAT loaded through signed SonicWall, IBM, Blue Iris and ON1 executables, with C2 configuration read from a BNB Smart Chain contract — The DFIR Report · pulled 2026-10-12

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: SectopRAT loaded through signed SonicWall, IBM, Blue Iris and ON1 executables, with C2 configuration read from a BNB Smart Chain contract

The DFIR Report lists 8 other indicators in this source.