← EtherHiding Tracker

0xb5d6959301bbb5d69593005000ffaba8a5a2ada2

0xb5d6959301bbb5d69593005000ffaba8a5a2ada2 is a cryptocurrency wallet address that one published source reports in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC. The report is dated 2026-09-25.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

wallet address EtherHiding / UNC5342NullReceiverContagious Interview CURATED

First seen 2026-09-25 · last seen 2026-09-25

Source

• As printed:

  03 Sep 2026 15:39 to 07 Sep 2026 13:52 0xB5D6959301bbB5D69593005000FfABa8a5A2ADA2 181.214.149.147:443 111

  Notes:

  Recipient address of the zero-value or 150 wei transfers that wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 sent between 3 to 7 September 2026 (111 beacons by Ransom-ISAC's count). It is not a wallet anyone holds keys to: its first six bytes encode 181.214.149.147:443, and the malware reads that endpoint as its C2. Taken from the cited table, not read from chain by this site. Ransom-ISAC labels the campaign DPRK-attributed.

  XCTDH Adopts Hash Hiding — Ransom-ISAC · published 2026-09-25 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 19 other indicators in this source. 12 are shown, chosen across types.

• 103.213.248.45 IP address
• 111.90.143.39 IP address
• 136.0.7.231 IP address
• 150.40.98.42 IP address
• 95.135.181.25 IP address
• 0x610c9ec972545b8df6e3aaecc7a8ab5f2f2445cf0bfbd6ee026e618d07b29e22 transaction hash
• 0x84e8cecd5b077eef530e7d69d546e2555199cb61759d1224d31cb31750788f62 transaction hash
• 0x171b14bb0050171b14bb01bb398eaab6441fbd47 cryptocurrency wallet address
• 0x171b14bb01bb171b14bb0050eb7f39c35c47e682 cryptocurrency wallet address
• 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 cryptocurrency wallet address
• TCqf6ZkaQD84vYsC2cuu1jRwB6JveTaRrF cryptocurrency wallet address
• TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH cryptocurrency wallet address

All 20 indicators from this source