← EtherHiding Tracker

0x788a5336c0ef70be87619a3c13a43050c426f7ec

0x788a5336c0ef70be87619a3c13a43050c426f7ec is a smart contract address that 2 published sources report in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Decryption Digest and Chollima Hunter (on-chain observation). The earliest of those reports is dated 2026-06-17 and the most recent 2026-07-08.

DPRK link unconfirmed Unit 42, as reported by Decryption Digest, attributes this campaign to an unidentified actor; no DPRK attribution is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

smart contract address EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-06-17 · last seen 2026-07-08

Sources

• As printed:

  0x6e044e19000487c4a6e6af15b4132a5561b5ee1f

  Notes:

  Ethereum contract that holds the command-and-control hosts of the EtherRAT fake Microsoft Teams IT-support campaign. Decryption Digest reports 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f as the campaign's resolver contract; on chain, that address sends the writes, and the hosts are stored here. This site's hunt of 2026-10-20 read 21 writes from it to this contract (selector 0x7fcaf666) between 2026-06-17 and 2026-09-01, naming ten hosts: six Microsoft Azure virtual-machine names under cloudapp.azure.com, the report's fallback domain necropatia.com, and three .com domains each registered on the day it was first written. The tracker reads it like the other watchlisted EtherRAT contracts.

  EtherRAT Microsoft Teams Attack: Blockchain C2 Hits Finance — Decryption Digest · published 2026-07-08 · pulled 2026-10-20

• Ethereum contract that holds the command-and-control hosts of the EtherRAT fake Microsoft Teams IT-support campaign. Decryption Digest reports 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f as the campaign's resolver contract; on chain, that address sends the writes, and the hosts are stored here. This site's hunt of 2026-10-20 read 21 writes from it to this contract (selector 0x7fcaf666) between 2026-06-17 and 2026-09-01, naming ten hosts: six Microsoft Azure virtual-machine names under cloudapp.azure.com, the report's fallback domain necropatia.com, and three .com domains each registered on the day it was first written. The tracker reads it like the other watchlisted EtherRAT contracts.

  Ethereum transaction 0x4b7ee335ac2bfd1dd298d28b2349a54b1af60f0df928cb8285c8153a5495b2ea (first write observed) — Chollima Hunter (on-chain observation) · published 2026-06-17 · pulled 2026-10-20

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT Microsoft Teams Attack: Blockchain C2 Hits Finance

Decryption Digest lists 3 other indicators in this source.

• camorreado.click domain
• necropatia.com domain
• 0x6e044e19000487c4a6e6af15b4132a5561b5ee1f smart contract address

Cited by the same report: Ethereum transaction 0x4b7ee335ac2bfd1dd298d28b2349a54b1af60f0df928cb8285c8153a5495b2ea (first write observed)

Chollima Hunter (on-chain observation) lists 1 other indicator in this source.

• resurce.swedencentral.cloudapp.azure.com domain