`0xb11613acf39ad3b4dde427c27068d278fafa8998`

0xb11613acf39ad3b4dde427c27068d278fafa8998 is a smart contract address that one published source reports in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from The DFIR Report. The report is dated 2026-10-12.

DPRK link unconfirmed The DFIR Report names SectopRAT (ArechClient2), commodity malware, and attributes this activity to no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`93.152.220.219`		Malicious	proxy or VPN	Dedik Services Limited AS207043	The Netherlands		reported
`96.62.218.59`		Malicious	fixed line	Dedik Services Limited AS207043	United States		reported

Write transactions

Every transaction that wrote a value to this contract, newest first, as read from BscScan on 2026-10-20. Values are shown as the operator wrote them; an encrypted one has not been decrypted.

Date	Transaction	Sender	Value written
2026-09-16	`0x2aedbbecd8b9…`	`0xe6975e145132…`	`STARTziYOchmYXAVEm6v+BMlo7a8MFc3q0e2a/daHR8AeKIc=FINISH`

smart contract address EtherHiding CURATED

First seen 2026-10-12 · last seen 2026-10-12

Source

As printed:

0xb11613acf39ad3b4dde427c27068d278fafa8998

Notes:

BNB Smart Chain contract SectopRAT reads in memory for its command-and-control configuration, in an intrusion The DFIR Report traced to DLL sideloading through signed SonicWall, IBM, Blue Iris and ON1 executables. On 2026-10-12 this site read its get() function, which returned an encrypted string between START and FINISH markers; the C2 hosts are those the report names.
SectopRAT loaded through signed SonicWall, IBM, Blue Iris and ON1 executables, with C2 configuration read from a BNB Smart Chain contract — The DFIR Report · pulled 2026-10-12

Find this indicator in the index, or see every smart contract address this site holds under Smart contract addresses in the browse listing.

Related indicators

Cited by the same report: SectopRAT loaded through signed SonicWall, IBM, Blue Iris and ON1 executables, with C2 configuration read from a BNB Smart Chain contract

The DFIR Report lists 8 other indicators in this source.