0xa658864ba658864b68656c6c6f6970626f742121
0xa658864ba658864b68656c6c6f6970626f742121 is a cryptocurrency wallet address
that 2 published sources report
in connection with EtherHiding / UNC5342, NullReceiver and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Chollima Hunter (on-chain observation) and OpenSourceMalware.
The earliest of those reports is dated 2026-08-02 and the most recent 2026-09-17.
On-chain links
| C2 host | Transaction | Verdict | Network | Provider | Country | Registered | First written | Last written |
|---|---|---|---|---|---|---|---|---|
166.88.134.75 |
Etherscan | Malicious | data centre | Ace Data Centers II | United Kingdom | 2026-09-17 | 2026-09-28 |
wallet address EtherHiding / UNC5342NullReceiverContagious Interview CURATED
Sources
-
Destination address of the NullReceiver lookup transaction from 2026-09-17 onwards, still current when this entry was written on 2026-09-20, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 166.88.134.75, and the trailing twelve bytes are the ASCII string "helloipbot!!", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 373 in a zero-value, zero-calldata transfer mined at 2026-09-17T10:35:35Z, the first of 33 such transfers to this destination, and it is the transaction the malware would resolve. The transaction was read from a public Ethereum RPC node and its sender, recipient and nonce re-fetched from a second independent provider, which returned the same values.
Ethereum transaction 0x8394df46a1b832271fd59a5d4ebcfe4eb10845e87e0cd8e5a73d930dbf96b644 — Chollima Hunter (on-chain observation) -
Destination address of the NullReceiver lookup transaction from 2026-09-17 onwards, still current when this entry was written on 2026-09-20, observed on chain by this site rather than taken from published reporting. It is not a wallet anyone holds keys to but a value chosen so its bytes carry the C2 address: bytes 0-3 and bytes 4-7 both read as 166.88.134.75, and the trailing twelve bytes are the ASCII string "helloipbot!!", the same construction OpenSourceMalware describes for the address it reported. It was paid by the watchlisted resolver wallet 0xa322e5f3d311d3080e6f0121063e9adc2490ef1a at nonce 373 in a zero-value, zero-calldata transfer mined at 2026-09-17T10:35:35Z, the first of 33 such transfers to this destination, and it is the transaction the malware would resolve. The transaction was read from a public Ethereum RPC node and its sender, recipient and nonce re-fetched from a second independent provider, which returned the same values.
NullReceiver's Blank Crypto Transfers Solves the Challenges of EtherHiding — OpenSourceMalware
Find this indicator in the index, or see every cryptocurrency wallet address this site holds under Cryptocurrency wallet addresses in the browse listing.