Crypto Account Tracking

This ransom TA, which we have named AzKa, targeted and ransomed the KLA. Based on our analysis and intelligence, he has a personal wallet that he uses to trade cryptocurrency, and we suspect he controls multiple wallets.

Please investigate which CEX platforms he uses, tx information, including transaction timestamps. We will share this information with NCNC so they can formally request the relevant account information from the CEX providers.

First, we find the account using the wallet ID provided at etherscan.io website.

The wallet showed 0 ETH, with an ETH value of $0.00. However, it had token holdings worth about $1,180.44 across 11 tokens. Next, we checked the Token Transfers (ERC-20) tab to review the wallet’s token activity. The key finding is that the wallet received several incoming token transfers, including large amounts of Kounotori (KTO) and SHIBA INU (SHIB).

The highlighted transactions show:

After checking the token transfer history, we looked at the sender wallet addresses.

The first sender wallet was:

0xCcD48eBe363F59701621598D7B377FAd34e14826

This wallet had a very small ETH balance, about 0.00846 ETH or $19.36. It only had 3 transactions, including activity with Kounotori (KTO) and Uniswap.

The second sender wallet was:

0x7705022949081FeADE8DD09b931eb562De9273Ad

This wallet also had a small ETH balance, about 0.00519 ETH or $11.94. It had 22 transactions, including activity with KTO, FLOKI Token, Uniswap, and Crypto.com.

To find the details about the transaction, we can click on the eye icon then click see more details .

From the transaction details below, we can retrieve the transaction hash (TX) and the timestamp.

Transaction 1:

TX: 0x340a0fce2ca9050081ef1f91b5f4290b1856e0a3b0234b00663a229bfd193f8f

Timestamp: Apr-03-2023 07:33:59 PM +UTC

Transaction 2:

TX: 0x6d6e112ff6598c77bdb40b31979941ffe047d66d9f02490b50255c9503c97988

Timestamp: Sep-07-2022 02:03:07 PM +UTC