`TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH`

TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH is a cryptocurrency wallet address that one published source reports in connection with EtherHiding / UNC5342 and Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Ransom-ISAC. The report is dated 2026-09-25.

On-chain links

C2 hosts this address pointed malware at, newest first. Dates are when the value was written on-chain, and Transaction opens the one that first wrote it; a row without one is a tie a cited report states. A host whose verdict is decoy was written between real values and is not C2. See the EtherHiding Tracker.

C2 host	Transaction	Verdict	Network	Provider	Country	First written	Last written
`89.19.222.25`	BscScan	Malicious	fixed line	Sysect D.O.O. AS202799	Russia	2026-10-05	2026-10-07
`181.214.149.148`	BscScan	Malicious	data centre	Tier.Net Technologies LLC AS397423	United States	2026-09-08	2026-09-26
`198.105.127.210`	BscScan	Malicious	data centre	Evoxt Sdn. Bhd. AS149440	United Kingdom	2025-11-19	2026-10-05

wallet address EtherHiding / UNC5342Contagious Interview CURATED

First seen 2026-09-25 · last seen 2026-09-25

Source

As printed:

TFMryB9m6d4kBMRjEVyFRbqKSV1cV2NcpH Chain 2 (→ /$/boot ) 0x3d2075f97b7b1e3234bd653779d21c605d7d8c6ec9c98d983880be5c7f4f9471

Notes:

TRON address the malware queries for its most recent outbound transaction. Chain 2 pointer in the September 2026 samples; its BSC payload fetches /$/boot and the OmniStealer dropper. The transaction's raw_data.data field holds a hex-encoded, reversed BSC transaction hash, which the malware then fetches from a BSC RPC node and decrypts as its next stage; an Aptos account is queried as a fallback. The address does not hold the payload and rotating the pointer is a single transaction. Ransom-ISAC, which calls the technique Cross-Chain TxDataHiding (XCTDH), says the targeting and operational priorities strongly suggest a DPRK-affiliated actor, and its part 4, written with Crystal Intelligence, reports funding traced to addresses involved in other DPRK thefts. The first part of the series rests on infrastructure and targeting rather than on a named cluster, so this entry carries the Contagious Interview label and no UNC cluster.
XCTDH Adopts Hash Hiding — Ransom-ISAC · published 2026-09-25 · pulled 2026-10-03

Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.

Related indicators

Cited by the same report: XCTDH Adopts Hash Hiding

Ransom-ISAC lists 19 other indicators in this source. 12 are shown, chosen across types.

All 20 indicators from this source