0xa1b40044ebc2794f207d45143bd82a1b86156c6b
0xa1b40044ebc2794f207d45143bd82a1b86156c6b is a smart contract address
that one published source reports
in connection with EtherHiding activity, which no
published source ties to North Korea (DPRK).
It is cited here from Unit 42 (Palo Alto Networks).
The report is dated 2026-07-21.
DPRK link unconfirmed Unit 42 lists this among npm and PyPI packages from "multiple distinct threat actors" and names none; the same contract and key are the Tsundere botnet's, which Kaspersky reported in November 2025 with no North Korean link. No published source ties it to North Korea. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.
On-chain links
| C2 host | Transaction | Verdict | Network | Provider | Country | Registered | First written | Last written |
|---|---|---|---|---|---|---|---|---|
66.78.40.120 unreviewed |
Etherscan | Malicious | 2026-09-01 | 2026-09-01 | ||||
91.236.230.101 unreviewed |
Etherscan | Malicious | 2025-11-01 | 2025-11-01 | ||||
45.150.109.174 unreviewed |
Etherscan | Malicious | 2025-09-30 | 2025-09-30 | ||||
45.66.249.196 unreviewed |
Etherscan | Malicious | 2025-09-23 | 2025-09-23 | ||||
178.17.59.37 unreviewed |
Etherscan | Malicious | 2025-09-21 | 2025-09-21 | ||||
185.28.119.179 unreviewed |
Etherscan | Malicious | 2025-08-19 | 2025-08-19 | ||||
196.251.72.192 unreviewed |
Etherscan | Malicious | 2025-08-03 | 2025-08-03 | ||||
103.246.145.201 unreviewed |
Etherscan | Malicious | 2025-07-14 | 2025-07-14 | ||||
193.24.123.68 |
Etherscan | Malicious | fixed line | Prospero OOO | Russia | 2025-06-21 | 2025-11-01 | |
62.60.226.179 unreviewed |
Etherscan | Malicious | 2025-05-04 | 2025-05-04 | ||||
65.87.7.150 unreviewed |
Etherscan | Malicious | 2025-04-08 | 2025-04-08 | ||||
2.60.226.195 unreviewed |
Etherscan | Malicious | 2025-04-04 | 2025-04-04 | ||||
62.60.226.195 unreviewed |
Etherscan | Malicious | 2025-04-04 | 2025-04-04 | ||||
5.252.153.116 unreviewed |
Etherscan | Malicious | 2025-03-24 | 2025-03-24 | ||||
185.177.239.252 unreviewed |
Etherscan | Malicious | 2025-02-28 | 2025-02-28 | ||||
fbi.gov unreviewed |
Etherscan | Malicious | 2024-11-28 | 2024-11-28 | ||||
185.169.253.162 unreviewed |
Etherscan | Malicious | 2024-11-10 | 2024-11-10 | ||||
194.53.54.188 unreviewed |
Etherscan | Malicious | 2024-10-26 | 2024-10-26 | ||||
193.233.201.21 unreviewed |
Etherscan | Malicious | 2024-10-22 | 2024-10-22 | ||||
45.125.67.172 unreviewed |
Etherscan | Malicious | 2024-09-24 | 2024-10-21 |
smart contract address EtherHiding CURATED
Source
-
0xa1b40044EBc2794f207D45143Bd82a1B86156c6b
Ethereum contract malicious npm packages call with getString(address) to read the server they download a node binary from, passing the key 0x52221c293a21D8CA7AFD01Ac6bFAC7175D590A84; Unit 42 listed both in July 2026.
Further malicious infrastructure from npm and PyPI supply chain packages — Unit 42 (Palo Alto Networks)
Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.