`0xc2da361c40279a4f2f84448791377652f2bf41f06d18f19941a96c720228cd0f`

0xc2da361c40279a4f2f84448791377652f2bf41f06d18f19941a96c720228cd0f is a transaction hash that one published source reports in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Google Threat Intelligence Group. The report is dated 2025-10-16.

transaction hash EtherHiding / UNC5342Contagious Interview CURATED

First seen 2025-10-16 · last seen 2025-10-16

Source

As printed:

The INVISIBLEFERRET.JAVASCRIPT payload may also be split into different components like is done at the transaction address 0xc2da361c40279a4f2f84448791377652f2bf41f06d18f19941a96c720228cd0f . The split up JavaScript payload executes the INVISIBLEFERRET.JAVASCRIPT backdoor and attempts to install a portable Python interpreter to execute an additional …

Notes:

Ethereum transaction GTIG lists as storing the split INVISIBLEFERRET.JAVASCRIPT payload. Confirmed on-chain at block 21,795,760, sent from the same owner address to the same burn address, carrying roughly 16.7 KB of calldata -- the largest of the three payload writes GTIG names.
DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains — Google Threat Intelligence Group · published 2025-10-16 · pulled 2026-08-30

Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.

Related indicators

Cited by the same report: DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains

Google Threat Intelligence Group lists 16 other indicators in this source. 12 are shown, chosen across types.

All 17 indicators from this source