0x596dcc9fda875309ff85eba09cf5a97d8c7691bb
0x596dcc9fda875309ff85eba09cf5a97d8c7691bb is a cryptocurrency wallet address
that 4 published sources report
in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and Ransom-ISAC.
The earliest of those reports is dated 2026-09-25 and the most recent 2026-10-12.
On-chain links
| C2 host | Transaction | Verdict | Network | Provider | Country | Registered | First written | Last written |
|---|---|---|---|---|---|---|---|---|
2.56.123.203 |
BscScan | Malicious | data centre | NetCrafters OU | United States | 2026-10-22 | 2026-11-11 | |
95.135.181.25 |
BscScan | Malicious | fixed line | 12651980 Canada Inc. | France | 2026-10-21 | 2026-10-21 | |
95.135.181.15 |
BscScan | Malicious | fixed line | 12651980 Canada Inc. | France | 2026-10-20 | 2026-11-11 | |
154.91.0.20 |
BscScan | Malicious | fixed line | Evoxt Enterprise | United Kingdom | 2026-10-06 | 2026-10-20 | |
166.0.106.182 |
BscScan | Malicious | data centre | Ace Data Centers | Canada | 2026-10-06 | 2026-10-20 |
wallet address EtherHiding / UNC5342Contagious Interview CURATED
Sources
-
Second Ethereum signal address of the XCTDH implant, first funded on 2026-10-06 by the watchlisted signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 and sending a transaction about every 256 blocks since. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Followed by hand on 2026-10-11, the second pointer's script is a socket.io remote-access tool and clipboard and file stealer whose C2 is 154.91.0.20 on port 443 and 166.0.106.182; the first pointer's is a loader for the next stage, and the third pointer's is a Node.js dropper that fetches a Python stage from 166.0.106.182 over HTTP. The third pointer moved on 2026-10-12 to BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4, a rebuilt dropper decoded statically the same day that names the same host, now posting to /u/snv and fetching /d/7zr.exe and /d/python.7z, and that checks for Vercel, GitHub runner and cloud hostnames before it runs. The decoding and the chain from this address are this site's own observation, made after Ransom-ISAC's report on the first signal wallet.
Ethereum transaction 0x26fad880c89e3085bb108c27c1514f4212a6560c46b8ecb9c33cd441c0605ec0 — Chollima Hunter (on-chain observation) -
Second Ethereum signal address of the XCTDH implant, first funded on 2026-10-06 by the watchlisted signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 and sending a transaction about every 256 blocks since. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Followed by hand on 2026-10-11, the second pointer's script is a socket.io remote-access tool and clipboard and file stealer whose C2 is 154.91.0.20 on port 443 and 166.0.106.182; the first pointer's is a loader for the next stage, and the third pointer's is a Node.js dropper that fetches a Python stage from 166.0.106.182 over HTTP. The third pointer moved on 2026-10-12 to BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4, a rebuilt dropper decoded statically the same day that names the same host, now posting to /u/snv and fetching /d/7zr.exe and /d/python.7z, and that checks for Vercel, GitHub runner and cloud hostnames before it runs. The decoding and the chain from this address are this site's own observation, made after Ransom-ISAC's report on the first signal wallet.
Ethereum transaction 0x1a0ecab889fcf804a2f7dd23f7b3e530690d62ee5d4854f67388b948be402eb9 — Chollima Hunter (on-chain observation) -
Second Ethereum signal address of the XCTDH implant, first funded on 2026-10-06 by the watchlisted signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 and sending a transaction about every 256 blocks since. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Followed by hand on 2026-10-11, the second pointer's script is a socket.io remote-access tool and clipboard and file stealer whose C2 is 154.91.0.20 on port 443 and 166.0.106.182; the first pointer's is a loader for the next stage, and the third pointer's is a Node.js dropper that fetches a Python stage from 166.0.106.182 over HTTP. The third pointer moved on 2026-10-12 to BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4, a rebuilt dropper decoded statically the same day that names the same host, now posting to /u/snv and fetching /d/7zr.exe and /d/python.7z, and that checks for Vercel, GitHub runner and cloud hostnames before it runs. The decoding and the chain from this address are this site's own observation, made after Ransom-ISAC's report on the first signal wallet.
XCTDH Adopts Hash Hiding — Ransom-ISAC -
Second Ethereum signal address of the XCTDH implant, first funded on 2026-10-06 by the watchlisted signal wallet 0x33ff3edaf55a8e03dcbc7cb40d498a49cd499891 and sending a transaction about every 256 blocks since. The 2026-10-07 XCTDH loader, decoded statically by this site, samples Ethereum blocks five to seven past each multiple of 256 for a transaction sent from an address containing 596dcc9fda875309ff85eba09cf5a97d, and reads that transaction's recipient as four packed pointers of four bytes of BNB Smart Chain block number and one byte of transaction index. Each pointer leads to a BSC transaction whose input carries a script between ?.? markers, XOR-encrypted under a key the previous stage names. Followed by hand on 2026-10-11, the second pointer's script is a socket.io remote-access tool and clipboard and file stealer whose C2 is 154.91.0.20 on port 443 and 166.0.106.182; the first pointer's is a loader for the next stage, and the third pointer's is a Node.js dropper that fetches a Python stage from 166.0.106.182 over HTTP. The third pointer moved on 2026-10-12 to BSC transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4, a rebuilt dropper decoded statically the same day that names the same host, now posting to /u/snv and fetching /d/7zr.exe and /d/python.7z, and that checks for Vercel, GitHub runner and cloud hostnames before it runs. The decoding and the chain from this address are this site's own observation, made after Ransom-ISAC's report on the first signal wallet.
BNB Smart Chain transaction 0x304e337f173d6d4efa3bc6f483e4afe457f01d7f0e51cab39ad05f0f88050ce4 — Chollima Hunter (on-chain observation)
Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.