5728b11d30586bbfc1d8bd12df1c722a06e767a2SHA-1 hash
Reported by 1 independent source · first reported by SentinelLabs · last reported
Last reported 1 month ago
What the reports say
1 report, newest first · the exact sentence from each-
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties“…nouncement of the KelpDAO incident, the attackers deployed a new version of ROOFDECK to the compromised machine (SHA-1: 5728b11d30586bbfc1d8bd12df1c722a06e767a2, path ~/Library/com.apple.appleaccountd/loginwindow) as an executable named loginwindow.”
Indicators reported together
named in the same reports- registry.hashicorp-aws[.]comin 1 report
- registry.hashicorp-aws[.]ioin 1 report
- registry.hashicorp-terraform[.]ioin 1 report
- 176.97.114[.]232in 1 report
- 45.11.59[.]140in 1 report
- 85.137.56[.]10in 1 report
- grenight[.]comin 1 report
- 85.137.56[.]245in 1 report
- api.nostr[.]watchin 1 report
- nostr[.]momin 1 report
- relay.snort[.]socialin 1 report
- offchain[.]pubin 1 report
- nostr.oxtr[.]devin 1 report
- nostr[.]winein 1 report
- 1cd6d13ff15adbf7a42025d10ec99b4ain 1 report
- 02df07a173ab03b8…fff8b1467f28in 1 report
- c491d477dbe0ae04…144c03f73ec4in 1 report
- technicais.sytes[.]netin 1 report
- storage.hubpage[.]cloudin 1 report
- 4b2d3e8ccce8920a…8b416b731daain 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.