← EtherHiding Tracker

0x4f1dd066b832af641b5f08537a5b0fc0b329d5ec

0x4f1dd066b832af641b5f08537a5b0fc0b329d5ec is a cryptocurrency wallet address that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Atos Threat Research Center. The report is dated 2026-04-14.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

wallet address EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-04-14 · last seen 2026-04-14

Source

• As printed:

  0x4f1dd066b832af641b5f08537a5b0fc0b329d5ec

  Notes:

  Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x47a397d9d459b05433f0d579e7842442b348ec38 (wallet created 2025-12-20); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.

  EtherRAT-appendixes (IoCs/wallets_and_contracts.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT-appendixes (IoCs/wallets_and_contracts.csv)

Atos Threat Research Center lists 96 other indicators in this source. 12 are shown, chosen across types.

• 135.125.255.55 IP address
• 173.249.8.102 IP address
• 193.233.126.94 IP address
• vhdcore/Disk2vhd malicious repository
• vmlets/VMware-Tools malicious repository
• winlabel/BgInfo malicious repository
• 0x22f96d61cf118efabc7c5bf3384734fad2f6ead4 smart contract address
• 0x277852e1c349b03c79e348018a8391bd21c412e8 smart contract address
• 0x3f35e6fbe1098f0685137ab81189e891939825af smart contract address
• 0x69a91686482de1df123b91106cbda763da034d4a cryptocurrency wallet address
• 0x6b007f4cb132a3a574b53ab6aa3f431e0c2d4a94 cryptocurrency wallet address
• 0x6c0bdc011f31715c4ff537aa9c6a8a141f8a6119 cryptocurrency wallet address

All 97 indicators from this source