0x07a02d3bda74523a8571482380f2c8a24cfe24db03c96714abfebad44a60c404
0x07a02d3bda74523a8571482380f2c8a24cfe24db03c96714abfebad44a60c404 is a transaction hash
that one published source reports
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Ransom-ISAC.
The report is dated 2025-12-08.
transaction hash EtherHiding / UNC5342Contagious Interview CURATED
Source
-
Furthermore, we noted that the second contract initiated, 0x07a02d3bda74523a8571482380f2c8a24cfe24db03c96714abfebad44a60c404 , occuring on Feb-07-2025 04:47:45 AM UTC was actually the first Python Downloader ( Payload1_2 (HTTP Payload Stager) ) which ultimately leads to downloading the …
BNB Smart Chain transaction whose input field carries an encrypted JavaScript stage that the malware fetches with eth_getTransactionByHash: the first Python downloader (Payload1_2) in the series, on 7 February 2025, whose C2 is 154.91.0.103:27017 and which leaves the string BEP-20: BOT250205. Recorded from the cited indicator table; this site has not decrypted the calldata. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
Cross-Chain TxDataHiding Crypto Heist: A Very (Very) Chainful Process (Part 4) — Ransom-ISAC
Find this indicator in the index, or see every transaction hash this site holds under Transaction hashes in the browse listing.