0x0f705fd19dddd0136bb850eb2f5753c8ee13f8aa9aec57e2d809684352cc7347
0x0f705fd19dddd0136bb850eb2f5753c8ee13f8aa9aec57e2d809684352cc7347 is a transaction hash
that 2 published sources report
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Google Threat Intelligence Group.
The earliest of those reports is dated 2025-10-16 and the most recent 2026-09-03.
transaction hash EtherHiding / UNC5342Contagious Interview CURATED
Sources
-
Ethereum transaction sent at 14:38:47 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 17,117 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.
Ethereum transaction 0x0f705fd19dddd0136bb850eb2f5753c8ee13f8aa9aec57e2d809684352cc7347 — Chollima Hunter (on-chain observation) -
Ethereum transaction sent at 14:38:47 UTC on 2025-02-07 from 0x9bc1355344b54dedf3e44296916ed15653844509, the owner address already in this watchlist, to the burn address 0x000000000000000000000000000000000000dEaD, carrying 17,117 bytes of calldata and no value. It is one of ten such transactions this site found by enumerating that wallet, of which GTIG lists three; this is one of the seven that appear in no reporting this site is aware of. Its calldata carries the same profile as the three that are reported -- comparable size, and 6.2 to 6.3 bits of entropy per byte, so encoded or encrypted rather than readable. The payload was not decoded and no malware family is asserted for it here: what is established is the sender, the destination, the timing inside the same five-hour window, and the shape.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group
Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.