0xf93c0b6873f55eedccd12bc79781fc6d8b14f6c8e2b0e9d8f24f39b5294b6b6b
0xf93c0b6873f55eedccd12bc79781fc6d8b14f6c8e2b0e9d8f24f39b5294b6b6b is a transaction hash
that 2 published sources report
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Google Threat Intelligence Group.
The earliest of those reports is dated 2025-10-16 and the most recent 2026-09-03.
transaction hash EtherHiding / UNC5342Contagious Interview CURATED
Sources
-
Ethereum transaction sent at 14:43:11 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 16,256 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.
Ethereum transaction 0xf93c0b6873f55eedccd12bc79781fc6d8b14f6c8e2b0e9d8f24f39b5294b6b6b — Chollima Hunter (on-chain observation) -
Ethereum transaction sent at 14:43:11 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 16,256 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group
Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.