`0x3372a63ee825d09b4daee979513980f99c731db5`

0x3372a63ee825d09b4daee979513980f99c731db5 is a cryptocurrency wallet address that one published source reports in connection with EtherHiding / UNC5342 and unclustered DPRK activity, which public reporting attributes to North Korea (DPRK). It is cited here from Atos Threat Research Center. The report is dated 2026-04-14.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	Registered	First written	Last written
`dns1.southafricanorth.cloudapp.azure.com`	Etherscan	Malicious					2026-06-27	2026-06-27
`waygatterol002.com`	Etherscan	Malicious				2026-02-19	2026-02-23	2026-02-23
`jariosos.com`	Etherscan	Malicious				2025-12-17	2026-02-14	2026-02-14
`135.125.255.55`	Etherscan	Malicious	data centre	OVH SAS AS16276	Germany		2026-01-03	2026-01-03

wallet address EtherHiding / UNC5342DPRK (cluster unattributed) CURATED

First seen 2026-04-14 · last seen 2026-04-14

Source

As printed:

0x3372a63ee825d09b4daee979513980f99c731db5

Notes:

Wallet that Atos's appendix pairs with the EtherRAT resolver contract 0x1a3f8e013c392d8cf6ca5049ee7f437b383f27e1 (wallet created 2026-01-03); it writes the C2 with setString and is the key the implant passes to getString(address). Atos names no actor of its own: it repeats Sysdig's link between EtherRAT and the DPRK Contagious Interview tooling and notes code overlap with a tool eSentire attributed to an Iranian group, so this entry is filed under the unattributed DPRK label.
EtherRAT-appendixes (IoCs/wallets_and_contracts.csv) — Atos Threat Research Center · published 2026-04-14 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: EtherRAT-appendixes (IoCs/wallets_and_contracts.csv)

Atos Threat Research Center lists 96 other indicators in this source. 12 are shown, chosen across types.

All 97 indicators from this source