`0xb5d6959401bbb5d69594005000ff8c84e0b715b1`

0xb5d6959401bbb5d69594005000ff8c84e0b715b1 is a cryptocurrency wallet address that one published source reports in connection with NullReceiver activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC. The report is dated 2026-09-25.

wallet address NullReceiver MATCHED IN SOURCE

Listed as Ethereum

First seen 2026-09-25 · last seen 2026-09-25

Source

…The to field is a 20-byte value, and the malware reads the first six bytes as the C2 endpoint it needs: to = 0xB5D6959401bbb5D69594005000ff8C84e0b715b1 ││││││││││││ ││││││││└┴┴┴── Port: 01bb → 443 └┴┴┴┴┴┴┴────── IP: B5.D6.95.94 → 181.214.149.148 The remaining bytes hold a secondary…
XCTDH Adopts Hash Hiding — Ransom-ISAC · under “The HashHiding Technique” · published 2026-09-25 · pulled 2026-10-01

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 3 other indicators in this source.