← EtherHiding Tracker

0x5953f27f044779a3afcd2bf56a4b712583dd2e4e

0x5953f27f044779a3afcd2bf56a4b712583dd2e4e is a cryptocurrency wallet address that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from The DFIR Report. The report is dated 2026-05-11.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

wallet address EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-05-11 · last seen 2026-05-11

Source

• As printed:

  0x5953f27F044779a3AFCd2BF56a4B712583Dd2E4e

  Notes:

  Wallet that deployed the EtherRAT resolver contract 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 and writes its C2 values; it is also the key the implant passes to getString(address). Listed by The DFIR Report. The DFIR Report published this deployment as EtherRAT in an intrusion that ended in The Gentlemen ransomware and names no nation-state; the DPRK label rests only on Sysdig's attribution of the EtherRAT family, so this entry carries low confidence and should not be read as a DPRK attribution of the intrusion itself.

  Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware — The DFIR Report · published 2026-05-11 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

The DFIR Report lists 12 other indicators in this source.

• afford-effect-construct-tricks.trycloudflare.com domain
• entered-medications-motherboard-advanced.trycloudflare.com domain
• fields-pct-easier-vancouver.trycloudflare.com domain
• howto-tar-naturals-coordination.trycloudflare.com domain
• mode-exit-legendary-trusted.trycloudflare.com domain
• rapids-lil-lending-charleston.trycloudflare.com domain
• seasonal-estimation-heating-necessarily.trycloudflare.com domain
• walt-messaging-affairs-occurring.trycloudflare.com domain
• when-architectural-cdna-faster.trycloudflare.com domain
• witch-skins-lip-coal.trycloudflare.com domain
• workshop-lighting-protective-customs.trycloudflare.com domain
• 0xdf0b529043ef7a2bb9111bad26de624a326bacf9 smart contract address