← EtherHiding Tracker

0x8eac3198dd72f3e07108c4c7cff43108ad48a71c

0x8eac3198dd72f3e07108c4c7cff43108ad48a71c is a smart contract address that 3 published sources report in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Google Threat Intelligence Group, Chollima Hunter (on-chain observation) and Ransom-ISAC. The earliest of those reports is dated 2025-10-16 and the most recent 2026-09-03.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from BscScan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Show 50 more

smart contract address EtherHiding / UNC5342Contagious Interview CURATED

Listed as Ethereum

First seen 2025-10-16 · last seen 2026-09-03

Sources

• As printed:

  The initial downloader queries the BNB Smart Chain through a variety of API providers, including Binplorer , to read the JADESNOW payload stored at the smart contract at address 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c .

  Notes:

  BNB Smart Chain smart contract publicly reported by Google Threat Intelligence Group (GTIG)/Mandiant as used by DPRK actor UNC5342 to host a second-stage JADESNOW payload retrieved via EtherHiding. A JavaScript downloader queries this contract's stored data via chain RPC calls to fetch and execute the payload, giving the actor a takedown-resistant hosting layer. This site read the contract directly on 2026-09-03 and reconstructed its write history from archive state, which no indexer covers because the contract emits no events. It was deployed 2025-02-07T04:47:45Z and its stored payload was rewritten 23 times through 2025-05-30, every write sent by the watchlisted owner address to selector 0xd3fc9864. The payload at deployment was 2,520 bytes that base64-decode to 1,890 bytes of readable obfuscated JavaScript; the payload it has served unchanged since 2025-05-30 is 5,216 bytes decoding to 3,909 bytes at 6.64 bits of entropy per byte, so encoded rather than readable. Between those two the payload swung between full multi-kilobyte scripts and short strings as brief as 28 bytes, so the contract was not only rotated but repurposed. The contract also carries the token-shaped cover strings "BOT250205" and "BOT", a name whose digits match its deployment week.

  DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-08-13

• BNB Smart Chain smart contract publicly reported by Google Threat Intelligence Group (GTIG)/Mandiant as used by DPRK actor UNC5342 to host a second-stage JADESNOW payload retrieved via EtherHiding. A JavaScript downloader queries this contract's stored data via chain RPC calls to fetch and execute the payload, giving the actor a takedown-resistant hosting layer. This site read the contract directly on 2026-09-03 and reconstructed its write history from archive state, which no indexer covers because the contract emits no events. It was deployed 2025-02-07T04:47:45Z and its stored payload was rewritten 23 times through 2025-05-30, every write sent by the watchlisted owner address to selector 0xd3fc9864. The payload at deployment was 2,520 bytes that base64-decode to 1,890 bytes of readable obfuscated JavaScript; the payload it has served unchanged since 2025-05-30 is 5,216 bytes decoding to 3,909 bytes at 6.64 bits of entropy per byte, so encoded rather than readable. Between those two the payload swung between full multi-kilobyte scripts and short strings as brief as 28 bytes, so the contract was not only rotated but repurposed. The contract also carries the token-shaped cover strings "BOT250205" and "BOT", a name whose digits match its deployment week.

  Contract 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c on BNB Smart Chain — Chollima Hunter (on-chain observation) · published 2026-09-03 · pulled 2026-08-13

• …Smart Chain through a variety of API providers, including Binplorer , to read the JADESNOW payload stored at the smart contract at address 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c .…

  DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains | Google Cloud Blog — Google Threat Intelligence Group · under “JADESNOW On-Chain Analysis” · published 2025-10-16 · pulled 2026-10-18

• …the BOT250205 token, which was allocated to several of the BSC addresses used by the malware deployer. https://bscscan.com/address/0x8eac3198dd72f3e07108c4c7cff43108ad48a71c The obfuscation used here is much simpler and seems like a prototype from the more sophisticated techniques we saw in the earlier parts…

  Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC · under “Initial Stager” · published 2025-12-08 · pulled 2026-10-03

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 12 are shown, chosen across types.

• 01fd153bfb4be440dd46cea7bebe8eb61b1897596523f6f6d1a507a708b17cc7 file hash
• 970307708071c01d32ef542a49099571852846a980d6e8eb164d2578147a1628 file hash
• 154.91.0.103 IP address
• 23.27.20.143 IP address
• 0x9bc1355344b54dedf3e44296916ed15653844509 smart contract address
• 0x5c77567fcf00c317b8156df8e00838105f16fdd4fbbc6cd83d624225397d8856 transaction hash
• 0x86d1a21fd151e344ccc0778fd018c281db9d40b6ccd4bdd3588cb40fade1a33a transaction hash
• 0x8d31cc22ceb128ea1b70704f9cfdf2f87a60dac547101623e02c22ff014241a9 transaction hash
• 0xc2da361c40279a4f2f84448791377652f2bf41f06d18f19941a96c720228cd0f transaction hash
• 0xe2a54e1d101946e92b04a19fb14ca63a7a5a7af9841cee7f00e68995a2621a98 transaction hash
• 0xf93c0b6873f55eedccd12bc79781fc6d8b14f6c8e2b0e9d8f24f39b5294b6b6b transaction hash
• 0xf9d432745ea15dbc00ff319417af3763f72fcf8a4debedbfceeef4246847ce41 transaction hash

All 17 indicators from this source