← EtherHiding Tracker

0x37ef6e88425613564b2cf8adc496acff4b6481a9

0x37ef6e88425613564b2cf8adc496acff4b6481a9 is a cryptocurrency wallet address that 2 published sources report in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Atos Threat Research Center. The reports are dated 2026-04-14.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

wallet address EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

Listed as Ethereum

First seen 2026-04-14 · last seen 2026-04-14

Sources

• As printed:

  0x37ef6e88425613564b2cf8adc496acff4b6481a9

  Notes:

  Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 (wallet created 2026-03-30); it writes the C2 with setString and is the key the implant passes to getString(address). Atos's article uses this contract and wallet as its worked example and names the wallet as the one that funded the contract. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.

  EtherRAT-appendixes (IoCs/wallets_and_contracts.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

• As printed:

  For the purpose of this explanation, we used one of the contracts used by attackers ( 0xc12c8d8f9706244eca0acf04e880f10ff4e52522) and wallet that funded it ( 0x37ef6e88425613564b2cf8adc496acff4b6481a9).

  Notes:

  Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 (wallet created 2026-03-30); it writes the C2 with setString and is the key the implant passes to getString(address). Atos's article uses this contract and wallet as its worked example and names the wallet as the one that funded the contract. Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.

  EtherRAT distribution: spoofing administrative tools via GitHub facades — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

• …this explanation, we used one of the contracts used by attackers ( 0xc12c8d8f9706244eca0acf04e880f10ff4e52522) and wallet that funded it ( 0x37ef6e88425613564b2cf8adc496acff4b6481a9).…

  EtherRAT distribution spoofing administrative tools via GitHub facades — Atos Threat Research Center · under “Decentralized C2 Infrastructure” · published 2026-04-14 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT-appendixes (IoCs/wallets_and_contracts.csv)

Atos Threat Research Center lists 96 other indicators in this source. 7 are shown, chosen across types.

• 91.215.85.42 IP address
• 91.221.190.12 IP address
• tcpvmon/TCPView malicious repository
• teracli/Tera-Term malicious repository
• 0x1cfb457d41b9e5eb6737fde2b590d1f78924aaa8 smart contract address
• 0x21f9a727e9668a3fc30393a344d8a3a98f4f3b8d smart contract address
• 0x434a2001add7e414da33612c4a8aee745ea22968 cryptocurrency wallet address

All 97 indicators from this source

Cited by the same report: EtherRAT distribution: spoofing administrative tools via GitHub facades

Atos Threat Research Center lists 44 other indicators in this source. 5 are shown, chosen across types.

• 135.125.255.55 IP address
• applck/AppLocker malicious repository
• autify5/Autologon malicious repository
• azpath/AzCopy malicious repository
• 0xc12c8d8f9706244eca0acf04e880f10ff4e52522 smart contract address

All 45 indicators from this source