`0xa3a603f8a454a9c905b4c579bb72628f7c15c2a0`

0xa3a603f8a454a9c905b4c579bb72628f7c15c2a0 is a smart contract address that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Prophet Security. The report is dated 2026-07-22.

DPRK link unconfirmed Prophet Security says only that the initial access matches publicly reported Contagious Interview activity, at moderate confidence, and names no actor. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Verdict	Registered	First written
`67sixcebeh.surf`	Malicious	2026-07-20	reported
`apdhlhs3.xyz`	Malicious	2026-06-29	reported
`bduwih8.pro`	Malicious	2026-06-28	reported
`citcix6.xyz`	Malicious	2026-06-05	reported
`gesck4m.pro`	Malicious	2026-05-27	reported
`hf98x4d.site`	Malicious	2026-06-06	reported
`j9af4sr.guru`	Malicious	2026-06-30	reported
`johncon.my`	Malicious		reported
`sj98xe4.xyz`	Malicious	2026-05-27	reported
`smdh7.surf`	Malicious	2026-06-05	reported
`xuiaxwx.com`	Malicious	lapsed	reported

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from Polygonscan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-10-19	`0x0ee0241d4a43…`	`0x363aeaf1f67f…`	`secdarvin2026.icu`
2026-10-19	`0x7eb23bce5eaf…`	`0x363aeaf1f67f…`	`zttrych.icu`
2026-10-13	`0x5d23e5d235da…`	`0x363aeaf1f67f…`	`zmngfjl.fun`
2026-10-12	`0xddba26ce8522…`	`0x363aeaf1f67f…`	`xzttyt.xyz`
2026-10-11	`0x428420011943…`	`0x363aeaf1f67f…`	`payload1717.pro`
2026-10-10	`0x3ffd693347d0…`	`0x363aeaf1f67f…`	`gran1xea.xyz`
2026-10-10	`0xe36971e7b965…`	`0x363aeaf1f67f…`	`samehoo229.fun`
2026-10-09	`0x3161dacd42c9…`	`0x363aeaf1f67f…`	`pobruog.wiki`
2026-10-08	`0xcb0b8ea256bd…`	`0x363aeaf1f67f…`	`mgxyuko.xyz`
2026-10-05	`0xb2ed028022f6…`	`0x363aeaf1f67f…`	`sayosay.cc`
2026-10-05	`0x8e444d60e7de…`	`0x363aeaf1f67f…`	`crying881.beer`
2026-10-03	`0x34a064ed6319…`	`0x363aeaf1f67f…`	`jrxciw2.xyz`
2026-10-02	`0xec5c3128a8ee…`	`0x363aeaf1f67f…`	`couhe79.xyz`
2026-10-01	`0xe7144c9ad80c…`	`0x363aeaf1f67f…`	`nomaiei.sbs`
2026-09-30	`0xbc95b4c22ddf…`	`0x363aeaf1f67f…`	`hugg1ngvx.top`
2026-09-30	`0x8555c2c3680c…`	`0x363aeaf1f67f…`	`hahah1101.mom`
2026-09-28	`0x7d481a045932…`	`0x363aeaf1f67f…`	`bagueie.xyz`
2026-09-25	`0x973cd746d26c…`	`0x363aeaf1f67f…`	`xynero.xyz`
2026-09-22	`0x5fde0dcda3d0…`	`0x363aeaf1f67f…`	`electronic72.pro`
2026-09-22	`0xe5e0652a24d1…`	`0x363aeaf1f67f…`	`namanami.top`
2026-09-22	`0x79b04002d081…`	`0x363aeaf1f67f…`	`electronic72.pro`
2026-09-18	`0xddc33dab3105…`	`0x363aeaf1f67f…`	`namanami.top`
2026-09-07	`0xc538f82cf92e…`	`0x363aeaf1f67f…`	`d9mjs.sbs`
2026-08-31	`0xfa17ba4b0f74…`	`0x363aeaf1f67f…`	`machine628.baby`
2026-08-12	`0x8d3906c8e6f2…`	`0x363aeaf1f67f…`	`vg5sgxv.lol`
2026-07-31	`0xdb7f9f9a8bef…`	`0x363aeaf1f67f…`	`stv4ec5.shop`
2026-07-21	`0xc7da6917549e…`	`0x363aeaf1f67f…`	`67sixcebeh.surf`
2026-07-20	`0xc10bf95093d0…`	`0x363aeaf1f67f…`	`fbuytf67.click`
2026-07-19	`0xad5c0f332da5…`	`0x363aeaf1f67f…`	`8jdjpwka.baby`
2026-07-18	`0xedbd6146579d…`	`0x363aeaf1f67f…`	`okekjaiw.click`
2026-07-09	`0x8f1cf910656f…`	`0x363aeaf1f67f…`	`j9af4sr.guru`
2026-06-30	`0x59cb424dfb6f…`	`0x363aeaf1f67f…`	`apdhlhs3.xyz`
2026-06-29	`0xc862d1a83933…`	`0x363aeaf1f67f…`	`johncon.my`
2026-06-29	`0xd8b60a8bcd25…`	`0x363aeaf1f67f…`	`johncon.my`
2026-06-29	`0xd3e03fc35b97…`	`0x363aeaf1f67f…`	`apdhlhs3.xyz`
2026-06-28	`0x392a8af6e37d…`	`0x363aeaf1f67f…`	`bduwih8.pro`
2026-06-22	`0xe539e2813d71…`	`0x363aeaf1f67f…`	`sj98xe4.xyz`
2026-06-06	`0x8af610524742…`	`0x363aeaf1f67f…`	`hf98x4d.site`
2026-06-05	`0x5986d6dd12b4…`	`0x363aeaf1f67f…`	`citcix6.xyz`
2026-06-05	`0x6419d13fdcc4…`	`0x363aeaf1f67f…`	`smdh7.surf`
2026-06-02	`0x0a5105519bc3…`	`0x363aeaf1f67f…`	`sj98xe4.xyz`
2026-05-27	`0x733508d294ed…`	`0x363aeaf1f67f…`	`gesck4m.pro`
2026-05-25	`0xe156cc110f28…`	`0x363aeaf1f67f…`	`example.com`
2026-05-18	`0x730bd145d943…`	`0x363aeaf1f67f…`	`xuiaxwx.com`
2026-05-18	`0x290acb5fcab5…`	`0x363aeaf1f67f…`	`https://vk.com/`
2026-05-01	`0xce345d4a2069…`	`0x363aeaf1f67f…`	`facebook.com`
2026-05-01	`0xbe6ce52a1584…`	`0x363aeaf1f67f…`	`rutube.ru`

smart contract address EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-07-22 · last seen 2026-07-22

Source

As printed:

0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0

Notes:

Polygon contract a macOS implant reads for its command-and-control domain (getter selector 0x2686ecea, setter 0xd75d1ba6), written from 2026-05-18; Prophet Security lists eleven domains it served, the current one 67sixcebeh.surf when read on 2026-07-21.
EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain — Prophet Security · published 2026-07-22 · pulled 2026-10-11

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain

Prophet Security lists 12 other indicators in this source.