`5728b11d30586bbfc1d8bd12df1c722a06e767a2`

5728b11d30586bbfc1d8bd12df1c722a06e767a2 is a file hash that one published source reports in connection with Lazarus Group activity, which public reporting attributes to North Korea (DPRK). It is cited here from SentinelOne. The report is dated 2026-09-18.

file hash Lazarus Group MATCHED IN SOURCE

Listed as 5728b11d3058...

First seen 2026-09-18 · last seen 2026-09-18

Source

…first public announcement of the KelpDAO incident, the attackers deployed a new version of ROOFDECK to the compromised machine (SHA-1: 5728b11d30586bbfc1d8bd12df1c722a06e767a2 , path ~/Library/com.apple.appleaccountd/loginwindow ) as an executable named loginwindow . After the new version initialized and…
Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne — SentinelOne · under “Another version of ROOFDECK” · published 2026-09-18 · pulled 2026-09-29

Find this indicator in the index, or see every file hash this site holds under File hashes in the browse listing.

Related indicators

Cited by the same report: Don’t Call Us, We’ll Call Your APIs | TraderTraitor Backdoors Resurface on Victim With No Crypto Ties | SentinelOne

SentinelOne lists 12 other indicators in this source.