`0x1cfb457d41b9e5eb6737fde2b590d1f78924aaa8`

0x1cfb457d41b9e5eb6737fde2b590d1f78924aaa8 is a smart contract address that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Atos Threat Research Center. The report is dated 2026-04-14.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Registered	First written	Last written
`waygatterol002.com`	Etherscan	Malicious	2026-02-19	2026-02-23	2026-02-23
`mmdis-worls.com`	Etherscan	Malicious	2026-01-26	2026-01-26	2026-01-26
`mbml-writer-info.info`	Etherscan	Malicious	2026-01-23	2026-01-24	2026-01-26

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Etherscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-02-23	`0x180d04947bea…`	`0x6b007f4cb132…`	`https://waygatterol002.com`
2026-01-26	`0xdd00bb997caa…`	`0x6b007f4cb132…`	`https://mbml-writer-info.info`
2026-01-26	`0xb9f65a295e43…`	`0x6b007f4cb132…`	`https://mmdis-worls.com`
2026-01-24	`0xd10a797c509d…`	`0x6b007f4cb132…`	`https://mbml-writer-info.info`
2026-01-24	`0xd392420c1cd7…`	`0x6b007f4cb132…`	`https://mbml-writer-info.info`

smart contract address EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-04-14 · last seen 2026-04-14

Source

As printed:

0x1cfb457d41b9e5eb6737fde2b590d1f78924aaa8

Notes:

Ethereum contract that EtherRAT reads to find its command-and-control server, listed in Atos's appendix as created 2026-01-23 with 5 setString calls when the appendix was compiled. It stores a mapping from operator wallet to URL: the operator writes the C2 with setString(string) and the implant reads it with getString(address) (selector 0x7d434425). On 2026-10-03 getString(0x6b007f4cb132a3a574b53ab6aa3f431e0c2d4a94) against a public Ethereum node returned a URL, confirming the contract has this shape; the stored values are not recorded here because operators park the resolver on well-known domains between sessions. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.
EtherRAT-appendixes (IoCs/wallets_and_contracts.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT-appendixes (IoCs/wallets_and_contracts.csv)

Atos Threat Research Center lists 96 other indicators in this source. 12 are shown, chosen across types.

All 97 indicators from this source