`0xf9d432745ea15dbc00ff319417af3763f72fcf8a4debedbfceeef4246847ce41`

0xf9d432745ea15dbc00ff319417af3763f72fcf8a4debedbfceeef4246847ce41 is a transaction hash that one published source reports in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Google Threat Intelligence Group. The report is dated 2025-10-16.

transaction hash EtherHiding / UNC5342Contagious Interview CURATED

First seen 2025-10-16 · last seen 2025-10-16

Source

As printed:

… backdoor and attempts to install a portable Python interpreter to execute an additional credential stealer component stored at the transaction address 0xf9d432745ea15dbc00ff319417af3763f72fcf8a4debedbfceeef4246847ce41 . This additional credential stealer component targets web browsers like Google Chrome and Microsoft Edge to exfiltrate stored passwords, session cookies, and credit …

Notes:

Ethereum transaction GTIG lists as storing an additional INVISIBLEFERRET credential-stealer payload. Confirmed on-chain at block 21,795,000, again from the watchlisted owner address to the burn address, carrying roughly 27 KB of calldata.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-08-30

Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 12 are shown, chosen across types.

All 17 indicators from this source