`0xe1f2395ee43e45a1556ec6438a88c31b83493103`

0xe1f2395ee43e45a1556ec6438a88c31b83493103 is a smart contract address that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Crimson7. The report is dated 2026-08-10.

DPRK link unconfirmed Crimson7 ties this contract to the Shai-Hulud compromise of the keyv@6.0.0 npm package and names no actor or state. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`awqhnjewqjkl.icu`		Malicious				2026-08-04	reported

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Etherscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-05-25	`0x3184c1dfadc2…`	`0x55f9780e1492…`	`0x00000000000000000000000000000000000000000000000000000000000000e0000000000000000000000000000000000000000000000000000000000000000d6e706d2d63616368652e636f6d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c707970692d6765742e636f6d000000000000000000` `npm-cache.com` `pypi-get.com`

smart contract address EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-08-10 · last seen 2026-08-10

Source

As printed:

0xE1f2395ee43e45A1556EC6438a88c31B83493103

Notes:

Ethereum EtherHiding resolver contract found in the analysis of the compromised keyv@6.0.0 npm package (Shai-Hulud; Netskope calls the campaign ChainDrop); on 2026-08-06 it returned awqhnjewqjkl.icu.
EtherHiding: When Malware Hides Its C2 on the Blockchain — Crimson7 · published 2026-08-10 · pulled 2026-10-11

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: EtherHiding: When Malware Hides Its C2 on the Blockchain

Crimson7 lists 1 other indicator in this source.