`0xe6975e14513283a5161ca883437a4e4b7298f1ca`

0xe6975e14513283a5161ca883437a4e4b7298f1ca is a cryptocurrency wallet address that 2 published sources report in connection with EtherHiding activity, which no published source ties to North Korea (DPRK). It is cited here from Chollima Hunter (on-chain observation) and The DFIR Report. The earliest of those reports is dated 2026-09-16 and the most recent 2026-10-12.

DPRK link unconfirmed The DFIR Report names SectopRAT (ArechClient2), commodity malware, and attributes this activity to no actor or state; no DPRK link is published for it. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`93.152.220.219`		Malicious	proxy or VPN	Dedik Services Limited AS207043	The Netherlands		reported
`96.62.218.59`		Malicious	fixed line	Dedik Services Limited AS207043	United States		reported

wallet address EtherHiding CURATED

First seen 2026-09-16 · last seen 2026-10-12

Sources

BNB Smart Chain wallet that wrote the SectopRAT configuration to 0xb11613acf39ad3b4dde427c27068d278fafa8998 on 2026-09-16, and the same kind of encrypted START...FINISH configuration, through the same function (0x3d7403a3), to 5 other contracts it deployed: 0x4d12cffca41a212086f3d43bb37db32393eeb8bb, 0xf4852d108394a87c5a595d522683be586cf0cb4f, 0x0dc18c881a46e37de9703c390535cdb285d37a16, 0xdd31210b5b128fe7adc0298d5c6a6db2c7277c46, 0x1088cd8bb283bc88e72bf74d26c817a232b177db. Found by this site's EtherHiding hunt on 2026-10-12, which follows the wallet that writes a watchlisted contract.
BNB Smart Chain transaction 0x2aedbbecd8b96265d41f03df48ed98730a033aa51b80bb8ee000b44e5b406855 — Chollima Hunter (on-chain observation) · published 2026-09-16 · pulled 2026-10-12
As printed:

0xb11613acf39ad3b4dde427c27068d278fafa8998

Notes:

BNB Smart Chain wallet that wrote the SectopRAT configuration to 0xb11613acf39ad3b4dde427c27068d278fafa8998 on 2026-09-16, and the same kind of encrypted START...FINISH configuration, through the same function (0x3d7403a3), to 5 other contracts it deployed: 0x4d12cffca41a212086f3d43bb37db32393eeb8bb, 0xf4852d108394a87c5a595d522683be586cf0cb4f, 0x0dc18c881a46e37de9703c390535cdb285d37a16, 0xdd31210b5b128fe7adc0298d5c6a6db2c7277c46, 0x1088cd8bb283bc88e72bf74d26c817a232b177db. Found by this site's EtherHiding hunt on 2026-10-12, which follows the wallet that writes a watchlisted contract.
SectopRAT loaded through signed SonicWall, IBM, Blue Iris and ON1 executables, with C2 configuration read from a BNB Smart Chain contract — The DFIR Report · pulled 2026-10-12

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: SectopRAT loaded through signed SonicWall, IBM, Blue Iris and ON1 executables, with C2 configuration read from a BNB Smart Chain contract

The DFIR Report lists 8 other indicators in this source.