0x24622144ea31a93e38ae727792da8a016377f1c3d55fe5d6d51dcefd1aaee29b
0x24622144ea31a93e38ae727792da8a016377f1c3d55fe5d6d51dcefd1aaee29b is a transaction hash
that 2 published sources report
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Google Threat Intelligence Group.
The earliest of those reports is dated 2025-10-16 and the most recent 2026-09-03.
transaction hash EtherHiding / UNC5342Contagious Interview CURATED
Sources
-
Ethereum transaction sent at 13:26:47 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 27,073 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.
Ethereum transaction 0x24622144ea31a93e38ae727792da8a016377f1c3d55fe5d6d51dcefd1aaee29b — Chollima Hunter (on-chain observation) -
Ethereum transaction sent at 13:26:47 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 27,073 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group
Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.