Chollima Hunter

← EtherHiding Tracker

0x363aeaf1f67f1fb7abddc3f9806a301f1c64abe3

0x363aeaf1f67f1fb7abddc3f9806a301f1c64abe3 is a cryptocurrency wallet address that one published source reports in connection with EtherHiding and unclustered DPRK activity, which no published source ties to North Korea (DPRK). It is cited here from Prophet Security. The report is dated 2026-07-22.

DPRK link unconfirmed Prophet Security says only that the initial access matches publicly reported Contagious Interview activity, at moderate confidence, and names no actor. The EtherHiding tracker covers every reported EtherHiding contract and wallet, not only North Korean ones, so this value may belong to another actor.

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 hostTransactionVerdictNetworkProviderCountryRegisteredFirst writtenLast written
67sixcebeh.surf Malicious 2026-07-20 reported
apdhlhs3.xyz Malicious 2026-06-29 reported
bduwih8.pro Malicious 2026-06-28 reported
citcix6.xyz Malicious 2026-06-05 reported
gesck4m.pro Malicious 2026-05-27 reported
hf98x4d.site Malicious 2026-06-06 reported
j9af4sr.guru Malicious 2026-06-30 reported
johncon.my Malicious reported
sj98xe4.xyz Malicious 2026-05-27 reported
smdh7.surf Malicious 2026-06-05 reported
xuiaxwx.com Malicious lapsed reported

wallet address EtherHidingDPRK (cluster unattributed) CURATED

First seen 2026-07-22 · last seen 2026-07-22

Source

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain

Prophet Security lists 12 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.