0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22
0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22 is a transaction hash
that one published source reports
in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Ransom-ISAC.
The report is dated 2026-09-25.
transaction hash EtherHiding / UNC5342NullReceiverContagious Interview CURATED
Source
-
0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22 Chain 2 Sets C2 to http://181.214.149.148 , fetches /$/boot with XOR key ThZG+0jfXE6VAGOJ and UA Python-urllib/3.13
BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: September 2026 chain 2 payload, which Ransom-ISAC says decrypts to a loader that fetches /$/boot from 181.214.149.148 on port 80. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
XCTDH Adopts Hash Hiding — Ransom-ISAC
Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.