`0x5c77567fcf00c317b8156df8e00838105f16fdd4fbbc6cd83d624225397d8856`

0x5c77567fcf00c317b8156df8e00838105f16fdd4fbbc6cd83d624225397d8856 is a transaction hash that one published source reports in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Google Threat Intelligence Group. The report is dated 2025-10-16.

transaction hash EtherHiding / UNC5342Contagious Interview CURATED

First seen 2025-10-16 · last seen 2025-10-16

Source

As printed:

transactionHash: "0x5c77567fcf00c317b8156df8e00838105f16fdd4fbbc6cd83d624225397d8856",

Notes:

BNB Smart Chain transaction that writes the JADESNOW payload into the watchlisted contract. It appears in the GTIG report's narrative and figures rather than its indicator table, so it is recorded here with that provenance stated. Reading it from a public BNB Smart Chain node corroborates it directly: block 46,456,153, sent from the watchlisted owner address 0x9bc1355344b54dedf3e44296916ed15653844509 to the watchlisted contract 0x8eac3198dd72f3e07108c4c7cff43108ad48a71c with roughly 5.3 KB of calldata, which is the payload-update operation the report describes.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-08-30

Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 12 are shown, chosen across types.

All 17 indicators from this source