`0x86d1a21fd151e344ccc0778fd018c281db9d40b6ccd4bdd3588cb40fade1a33a`

0x86d1a21fd151e344ccc0778fd018c281db9d40b6ccd4bdd3588cb40fade1a33a is a transaction hash that one published source reports in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Google Threat Intelligence Group. The report is dated 2025-10-16.

transaction hash EtherHiding / UNC5342Contagious Interview CURATED

First seen 2025-10-16 · last seen 2025-10-16

Source

As printed:

The third stage is the INVISIBLEFERRET.JAVASCRIPT payload stored at the Ethereum transaction address 0x86d1a21fd151e344ccc0778fd018c281db9d40b6ccd4bdd3588cb40fade1a33a . This payload connects to the C2 server via port 3306, the default port for MySQL. It sends an initial beacon with the victim's hostname, username, operating system, …

Notes:

Ethereum transaction GTIG lists as storing the INVISIBLEFERRET.JAVASCRIPT payload. Reading it from a public Ethereum node confirms it was sent at block 21,794,376 from 0x9bc1355344b54dedf3e44296916ed15653844509 -- the owner address already in this watchlist -- to the burn address 0x000000000000000000000000000000000000dEaD, carrying roughly 6.9 KB of calldata. Sending the payload as calldata to an address nobody controls puts it permanently on-chain without paying for contract storage, and it is retrievable by anyone who knows the transaction hash.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-08-30

Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 12 are shown, chosen across types.

All 17 indicators from this source