Chollima Hunter

← EtherHiding Tracker

0x171b0d87171b0d8768656c6c6f6970626f742121

0x171b0d87171b0d8768656c6c6f6970626f742121 is a cryptocurrency wallet address that 2 published sources report in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and OpenSourceMalware. The earliest of those reports is dated 2026-08-02 and the most recent 2026-08-22.

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 hostTransactionVerdictNetworkProviderCountryRegisteredFirst writtenLast written
23.27.13.135 Etherscan Malicious data centre Ace Data Centers II AS149440 United Kingdom 2026-08-22 2026-08-27

wallet address EtherHiding / UNC5342NullReceiverContagious Interview CURATED

First seen 2026-08-02 · last seen 2026-08-22

Sources

  • Destination address the NullReceiver resolver wallet paid between 2026-08-22 and 2026-08-27, observed on chain by this site rather than taken from published reporting. Its bytes carry the C2 address in the construction OpenSourceMalware describes: bytes 0-3 and bytes 4-7 both read as 23.27.13.135, and the trailing twelve bytes are the ASCII string "helloipbot!!". The watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a paid it 48 times over six days in zero-value, zero-calldata transfers, beginning at nonce 179. This is the address that sat between the reported 166.88.134.62 and the later 166.88.73.46, and it appears in no published reporting this site is aware of.
    Ethereum transaction 0x2f185dbd85a69dcd693524089448a77606c7e5df475fa3a2467b1560835561c4 — Chollima Hunter (on-chain observation) · published 2026-08-22 · pulled 2026-09-03
  • Destination address the NullReceiver resolver wallet paid between 2026-08-22 and 2026-08-27, observed on chain by this site rather than taken from published reporting. Its bytes carry the C2 address in the construction OpenSourceMalware describes: bytes 0-3 and bytes 4-7 both read as 23.27.13.135, and the trailing twelve bytes are the ASCII string "helloipbot!!". The watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a paid it 48 times over six days in zero-value, zero-calldata transfers, beginning at nonce 179. This is the address that sat between the reported 166.88.134.62 and the later 166.88.73.46, and it appears in no published reporting this site is aware of.
    NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-09-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: Ethereum transaction 0x2f185dbd85a69dcd693524089448a77606c7e5df475fa3a2467b1560835561c4

Chollima Hunter (on-chain observation) lists 1 other indicator in this source.

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 11 are shown, chosen across types.

All 16 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.