0xc1f79026c1f7902668656c6c6f6970626f742121
0xc1f79026c1f7902668656c6c6f6970626f742121 is a cryptocurrency wallet address
that 2 published sources report
in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and OpenSourceMalware.
The earliest of those reports is dated 2026-08-02 and the most recent 2026-09-04.
On-chain links
| C2 host | Transaction | Verdict | Network | Provider | Country | Registered | First written | Last written |
|---|---|---|---|---|---|---|---|---|
193.247.144.38 |
Etherscan | Malicious | fixed line | Evoxt Enterprise | United Kingdom | 2026-09-04 | 2026-10-13 |
wallet address EtherHiding / UNC5342NullReceiverContagious Interview CURATED
Sources
-
Destination address of the NullReceiver lookup transaction between 2026-09-04 and 2026-09-17, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 193.247.144.38, and the trailing twelve bytes are the ASCII string "helloipbot!!", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 288 in a zero-value, zero-calldata transfer mined at 2026-09-04T00:49:11Z, the first of 85 such transfers to this destination, and it is the transaction the malware would resolve. The transaction was read from a public Ethereum RPC node and its sender, recipient and nonce re-fetched from a second independent provider, which returned the same values.
Ethereum transaction 0xe087ecadb59b0ce61b5bce89870a82f612935e7b19be018bfa3e5c6bfa6efe58 — Chollima Hunter (on-chain observation) -
Destination address of the NullReceiver lookup transaction between 2026-09-04 and 2026-09-17, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 193.247.144.38, and the trailing twelve bytes are the ASCII string "helloipbot!!", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 288 in a zero-value, zero-calldata transfer mined at 2026-09-04T00:49:11Z, the first of 85 such transfers to this destination, and it is the transaction the malware would resolve. The transaction was read from a public Ethereum RPC node and its sender, recipient and nonce re-fetched from a second independent provider, which returned the same values.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware
Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.