← EtherHiding Tracker

0xa322e5f3d311d3080e6f0121063e9adc2490ef1a

0xa322e5f3d311d3080e6f0121063e9adc2490ef1a is a cryptocurrency wallet address that 7 published sources report in connection with EtherHiding / UNC5342, NullReceiver, Contagious Interview and PolinRider activity, which public reporting attributes to North Korea (DPRK). It is cited here from OpenSourceMalware, Chollima Hunter (on-chain observation), Socket, SlowMist, BlueCyber and Jfrog. The earliest of those reports is dated 2026-08-02 and the most recent 2026-11-09.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

wallet address EtherHiding / UNC5342NullReceiverContagious InterviewPolinRider CURATED

Listed as Ethereum

First seen 2026-08-02 · last seen 2026-11-09

Sources

• As printed:

  Wallet Address: "0xa322e5f3d311d3080e6f0121063e9adc2490ef1a"

  Notes:

  Ethereum wallet hard-coded into trojanized npm packages reported by OpenSourceMalware as part of the DPRK Contagious Interview campaign. The malware does not read a payload from it. It looks up the wallet's most recent outbound transaction and takes that transaction's destination address, decoding a command-and-control IP out of the address bytes. OpenSourceMalware attributes the activity to the DPRK Contagious Interview campaign and names no UNC cluster, so no UNC5342 attribution is asserted here. The packages named in that reporting are bianira-ui and fluid-type-ui, with five further packages added in a later update. This site enumerated all 285 outbound transactions from this wallet on 2026-09-03 and found the resolved destination rotated three times: 166.88.134.62 from 2026-07-25 to 2026-08-22 across 178 transactions, 23.27.13.135 from 2026-08-22 to 2026-08-27 across 48, and 166.88.73.46 from 2026-08-28 to 2026-09-03 across 58. Only the first appears in the cited reporting; the other two are recorded here from chain data.

  NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware · published 2026-08-02 · pulled 2026-08-30

• Ethereum wallet hard-coded into trojanized npm packages reported by OpenSourceMalware as part of the DPRK Contagious Interview campaign. The malware does not read a payload from it. It looks up the wallet's most recent outbound transaction and takes that transaction's destination address, decoding a command-and-control IP out of the address bytes. OpenSourceMalware attributes the activity to the DPRK Contagious Interview campaign and names no UNC cluster, so no UNC5342 attribution is asserted here. The packages named in that reporting are bianira-ui and fluid-type-ui, with five further packages added in a later update. This site enumerated all 285 outbound transactions from this wallet on 2026-09-03 and found the resolved destination rotated three times: 166.88.134.62 from 2026-07-25 to 2026-08-22 across 178 transactions, 23.27.13.135 from 2026-08-22 to 2026-08-27 across 48, and 166.88.73.46 from 2026-08-28 to 2026-09-03 across 58. Only the first appears in the cited reporting; the other two are recorded here from chain data.

  Ethereum transaction 0x7f9dbf90249bab5c55023850a674f61d2c6844474ce889910fa6c0406884ee37 — Chollima Hunter (on-chain observation) · published 2026-09-03 · pulled 2026-08-30

• …release v1.2.13 (refreshes babel.config.cjs payload, marker A8-3292-2) PolinRider / NullReceiver C2 anchor (Ethereum wallet) 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a Matches the wallet published in the OpenSourceMalware NullReceiver research . File SHA-256 hashes (as they ship on npm today)…

  NPM Isn't Prepared For North Korean PolinRider Attack | OpenSourceMalware — OpenSourceMalware · under “PolinRider / NullReceiver C2 anchor (Ethereum wallet)” · published 2026-08-25 · pulled 2026-09-02

• …out the ASCII string "helloipbot!!" . In this code block, look for the following: Detection Signature: "A10-npm3!" Wallet Address: "0xa322e5f3d311d3080e6f0121063e9adc2490ef1a" Blockchain RPC Lookup: ["https://1rpc.io/eth", "https://eth.drpc.org"] global.i = "A10-npm3!", global.r = require, "object" ==…

  NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding | OpenSourceMalware — OpenSourceMalware · under “What NullReceiver does differently” · published 2026-08-02 · pulled 2026-09-11

• …visanduma/nova-two-factor@dev-using-inertia visanduma/nova-two-factor@dev-nova5 Dead-Drop Resolver Ethereum Sender Address # 0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a Resolved C2 IP Addresses # 193.247.144.38 166.88.73.46 166.88.134.62 23.27.13.135 Payload Files #…

  PolinRider Spreads Through Compromised GitHub Accounts and Packagist | Socket — Socket · under “Dead-Drop Resolver Ethereum Sender Address #” · published 2026-09-17 · pulled 2026-09-29

• …to return, the subsequent child process may not be reached. It is worth noting that we used MistTrack to analyze the malicious address 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a , whose initial funding came from FixedFloat. Press enter or click to view image in full size Three Tools, Three Roles The two…

  PolinRider Poisons Nova, Using On-Chain Transactions as a C2 Manager — SlowMist · under “From a Single Line of Configuration to On-Chain Resolution” · published 2026-09-21 · pulled 2026-10-01

• …, post-css-transfer , scrollbar-hide-plugin , tailwind-animation-founder Tài khoản npm: npmuser1101 , npmuser3002 Ví của kẻ tấn công: 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a IP C&C: 166.88.134.62 , 23.27.13.135 , 166.88.73.46 , 193.247.144.38 , 166.88.134.75 , 91.218.183.174 , 23.27.13.72 Chuỗi tĩnh:…

  EtherRAT phát tán qua giả mạo hỗ trợ IT trên Microsoft Teams: Smart contract Ethereum làm cơ chế phân giải C&C — BlueCyber · under “7.5. IoC” · published 2026-10-18 · pulled 2026-10-26

• …Decoded, it is the farm's loader: const SENDER='0xa322E5f3D311D3080e6f0121063e9aDC2490Ef1a'.toLowerCase(); const INDEXER_URL='https://eth.blockscout.com/api'; ... const[ip1,ip2]=decodeAddress(match.tx.to); ... await run_loader(new…

  Contagious Interview - One Interview Away From Infection - JFrog Security Research — Jfrog · under “The site hands out the loader itself” · published 2026-11-09 · pulled 2026-11-12

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding

OpenSourceMalware lists 15 other indicators in this source. 5 are shown, chosen across types.

• 166.88.73.46 IP address
• 193.247.144.38 IP address
• bianira-ui npm package
• fluid-type-ui npm package
• 0xa658492ea658492e68656c6c6f6970626f742121 cryptocurrency wallet address

All 16 indicators from this source

Cited by the same report: NPM Isn't Prepared For North Korean PolinRider Attack | OpenSourceMalware

OpenSourceMalware lists 11 other indicators in this source. 7 are shown, chosen across types.

• f5c6be4753d6613c97f1b10c4d93a5d97a8f4fb21eb13da0ed04b23a8a61c2f6 file hash
• @syncraft-labs/core@0.4.1 npm package
• @syncraft-labs/react@0.4.1 npm package
• @syncraft-labs/vue@0.4.1 npm package
• fetch-page-assets@1.2.10 npm package
• fetch-page-assets@1.2.11 npm package
• fetch-page-assets@1.2.12 npm package

All 12 indicators from this source