Authors: Victor Sandin and Christopher Kim

TLP: WHITE

1.  Executive Summary

On 17 February, the Cybersecurity Infrastructure Security Agency (CISA), the Federal Bureau of

Investigation (FBI), and the Department of Treasury (Treasury) published a joint report to highlight the cyber threat posed to cryptocurrency by North Korea, formally known as the Democratic People’s Republic of Korea (DPRK); the report also provides mitigation recommendations and indicators of compromise for detection.¹ The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.²

According to these agencies, the Lazarus Group is an advanced persistent threat (APT) group sponsored by the North Korean government. Since 2018, it has been targeting individuals and companies that run cryptocurrency exchanges and financial services, with various versions of AppleJeus, a trojanized cryptocurrency trading application. It enables threat actors to gain access to victims’ systems to steal cryptocurrency, and it is compatible with both Windows and MacOS operating systems.

Lazarus has launched multiple versions of AppleJeus since Kaspersky discovered it in 2018.³ The following sections of this report describe the capabilities of seven different versions of the malware, and there are many similarities across them. All use a Sectigo Secure Sockets Layer (SSL) certificate for the website marketing the malware. This kind of certificate is only domain-validated – the lowest level of authentication used to validate SSL certificates.

2.  Analysis

 

2.1.  Initial Vector

In early AppleJeus campaigns, Lazarus used fake websites disguised as legitimate cryptocurrency trading platforms to spread the malware. Lazarus now uses other additional initial infection vectors, such as socially engineered phishing emails and social networking.

2.2.  Targets

AppleJeus campaigns have targeted several industry sectors, including energy, finance, government, industry, technology and telecommunications. The DPRK likely views cryptocurrency theft as an opportunity to circumvent international sanctions imposed on them. More than 30 countries have been impacted over the last year by Lazarus’ activity, including Argentina, Australia, Belgium, Brazil, Canada, China, Denmark, Estonia, Germany, Hong Kong, Hungary, India, Ireland, Israel, Italy, Japan, Luxembourg, Malta, the Netherlands, New Zealand, Poland, Russia, Saudi Arabia, Singapore, Slovenia, South Korea, Spain, Sweden, Turkey, the United Kingdom, Ukraine, and the United States.

2.3.  AppleJeus Version 1: Celas Trade Pro

In this campaign – which was ongoing until at least late January 2021 – Lazarus used a phishing email that spoofed Celas LLC and lured victims into downloading a malicious program named Celas Trade Pro from the actor-controlled site celasllc[.]com. The program was a trojanized version of the legitimate cryptocurrency trading application, Q.T. Bitcoin Trader. The fake website allowed the victim to download either the Windows or MacOS version of the application.

When the user executed the Celas Trade Pro program, it installed and ran an embedded executable called Updater.exe,⁴ which collected victim host information, then encrypted the data with with a hard-coded XOR key (Moz&Wie;#t/6T!2y), prepended the encrypted data with the image header “GIF89a,” and finally sent the data to its command and control (C&C) server, celasllc[.]com/checkupdate[.]php. Celas Trade Pro eventually downloaded and installed FALLCHILL, a remote access trojan (RAT) attributed to North Korea by the U.S. government, inside the victim’s network.

From 29 May 2018 to 23 January 2021, the celasllc[.]com domain resolved to nine IPv4 addresses.

2.4.  AppleJeus Version 2: JMT Trading

Kaspersky discovered this campaign with a new version of AppleJeus in October 2019, due to similarities to the original malware. The campaign continued to be active until at least January 2021, although on 11 October 2019, the files on GitHub were updated to clean, non-malicious installers soon after Kaspersky tweeted about it.

In this campaign, a fake but legitimate-appearing cryptocurrency trading company called JMT Trading marketed a trojanized application on its website jmttrading[.]org. Users were able to download either a Windows or MacOS-supported version via a link to the company’s GitHub page. The download included a ZIP archive and TAR files containing the malware source code.

When a user executed the JMT Trading application, it installed and ran an embedded and heavily-obfuscated executable named CrashReporter.exe,⁵ which collected victim host information and encrypted the data with a hard-coded XOR key (X,%`PMk–Jj8s+6=15:20:11). The malware then sent the encrypted information to its C&C server, https[:]//beastgoc.com/grepmonux.php, with a multipart form data separator (–wMKBUqjC7ZMG5A5g). Unlike the Windows version, the MacOS installer did not have a digital certificate and thus warned the user before installation.

From 15 October 2016 to 22 January 2021, the jmttrading[.]org domain resolved to 14 IPv4 addresses.

2.5.  AppleJeus Version 3: Union Crypto

Two months after discovering the JMT Trading campaign above, Kaspersky found another new version of AppleJeus in December 2019 on Twitter. This malware version appears similar to another cryptocurrency application known as Blackbird Bitcoin Arbitrage and may even be a modification of this application. This version follows the previous AppleJeus versions’ pattern of imitating a legitimate cryptocurrency trading application, in this case Union Crypto, to market and distribute malware on the website unioncrypto[.]vip. Also similar to the previous versions, this one supports both Mac OS and Windows platforms. Through a VirusTotal report, a researcher found a download link (https://www.unioncrypto[.]vip/download/W6c2dq8By7luMhCmya2v97YeN) for the MacOS version of Union Crypto Trader. The open source community also found that the Windows version may have been distributed via the instant messaging service Telegram.

The Windows version consisted of an executable file that extracted a temporary MSI installer that dropped an embedded executable called UnionCryptoUpdater.exe.⁶ This executable installed itself as a service with a description stating it “Automatically installs updates for Union Crypto Trader.” It was set to run every time the user logged in, then collected the system information, combining it into a string that was MD5 hashed and stored in the auth_signature variable before sending it to its C&C server https[:]//unioncrypto[.]vip/update.

As with the previous version, the installer for MacOS had similar functionality to the Windows version, but it lacked a digital certificate and so the system will warn the user of that before installation.

From 5 June 2019 to 15 July 2020, the unioncrypto[.]vip domain resolved to five different IPv4 addresses.

2.6.  AppleJeus Version 4: Kupay Wallet

Several months later, on 13 March 2020, researchers found another version of AppleJeus on kupaywallet[.]com, the website of the fake but legitimate-appearing cryptocurrency company named Kupay Wallet. It appeared to be active until at least January 2021, and following the pattern of supporting both Windows and MacOS platforms.

Once the the malware runs its executable (Kupay.exe), an embedded executable (KupayUpgrade.exe)⁷ is extracted and executed. It installs itself as a service (“Automatic Kupay Upgrade”) to run every time the user logs on, then collects victim system information, which is combined into strings and sent to the C&C server https[:]//kupaywallet[.]com/kupay_update.php. The Kupay Wallet malware is also capable of reading and writing files, as well as executing additional commands via the terminal.

This version is very similar to a legitimate open source cryptocurrency wallet known as Copay, which is distributed by the Atlanta-based company BitPay. Kupay appears to be a modification of this application, containing BitPay as the company listed in its version information, as well as sending a DNS request to bitpay[.]com following a request to its own domain.

From 20 March 2020, to 16 January 2021, the kupaywallet[.]com domain resolved to one IPv4 address.

2.7.  AppleJeus Version 5: CoinGoTrade

Researchers found the fifth version of AppleJeus⁸ on the website for another fake cryptocurrency wallet called CoinGoTrade (coingotrade[.]com).

Following the previous patterns, CoinGoTrade was available for both Windows and MacOs. Once the user downloaded the executable, CoinGoTradeUpdate.exe⁹ installed itself as a service (“Automatic CoinGoTrade Upgrade”) to run every time the user logged on, collected victim system information, combined the information into strings and sent it to one of its C&C servers.

From February 28, 2020, to January 23, 2021, coingotrade[.]com resolved to one internet IPv4 address.

2.8.  AppleJeus Version 6: Dorusio

The sixth version of AppleJeus was also identified In March 2020. It was marketed and distributed by a fake but legitimate-looking company called Dorusio, on dorusio[.]com. It is a trojanized version of Copay, and apart from the Dorusio logo and two additional services, the wallet appears to be the same as the Kupay Wallet, and was available for both Windows and MacOS.

Once the executable ran, the DorusioUpgrade.exe¹⁰ executable followed the same steps as other versions: it installed itself as a service (“Automatic Dorusio Upgrade”) to run every time the user logged on, collected victim system information, combined the information in strings and sent it to one of its C&C servers.

From 30 March 2020 to 23 January 2021 dorusio[.]com resolved to one internet IPv4 address.

2.9.  AppleJeus Version 7: Ants2Whale

In late 2020, a new version of AppleJeus was identified that was marketed and distributed by a legitimate-looking company called Ants2Whale on their website, ants2whale[.]com. In this case, the website contained many grammatical errors indicating that the author was not likely a native English speaker. The website also stated the user must contact the website administrators to download Ants2Whale because it is a premium package.

Following the previous patterns, Ants2Whale was available for both Windows and MacOS; however, only the MacOS version was available for analysis. Analysis of the MacOS version confirmed that Ants2Whale¹¹ used the same techniques described in previous versions.

From 23 September 2020 to 22 January 2021 ants2whale[.]com domain resolved to one IPv4 address.

3.  Prevention and Mitigation

According to CISA, organizations whose networks have been infected by AppleJeus should immediately take these initial actions:

• Contact the FBI, CISA, or Treasury¹² immediately regarding any identified activity related to AppleJeus.
• Initiate an incident response plan.
• Create new keys for wallets, and/or move cryptocurrency to new wallets.
• Introduce a two-factor authentication solution as an extra layer of verification.
• Use hardware wallets, which keep the private keys in a separate, secured storage area.
• Move funds out of a compromised wallet. Do not use the malware listed in this advisory to transfer funds, and form all transactions offline and then broadcast them to the network all at once in a short online session, ideally prior to the attacker accessing them.
• Isolate impacted hosts from the network and reimage them.
• Assume the threat actors have moved laterally within the network and downloaded additional malware. Create isolated subnets to block any communication between possible impacted hosts and the rest of the network.
• Change all passwords to any accounts associated with impacted hosts. Ensure that there is no future credential reuse.
• Install anti-virus software to run daily deep scans of the host and keep them updated with the latest signatures daily.
• Install a Host Based Intrusion Detection (HIDS)-based software and keep it up-to-date.
• Ensure all software and hardware is up-to-date, and all patches have been installed. Follow the principle of least privilege, to reduce the risk surface of various assets.
• Ensure the network-based firewall is installed and/or up-to-date, and apply appropriate firmware upgrades on a regular basis.

To mitigate and reduce the risk of being affected by AppleJeus, consider the following recommendations:

3.1  Cryptocurrency Users

• Verify the source of cryptocurrency-related applications and avoid installing applications downloaded from the Internet without confirming its legitimacy.
• Use multiple wallets for key storage, splitting the cryptocurrency appropriately between cold and hot storage.
• Enable multi-factor authentication for both user and device verification. Pay special attention to any suspicious logins.
• Prioritise cryptocurrency service businesses that offer indemnity protections for lost or stolen cryptocurrency.
• Consider having a dedicated device for cryptocurrency management. Hardware wallets offer an extra layer of protection by keeping the keys separately.
• Rotate credentials regularly and use unique strong passwords for each service.

3.2  Financial Service Companies

• Verify compliance with Federal Financial Institutions Examination Council (FFIEC) handbooks.¹³
• Report suspicious cyber and financial activities.

3.3  Cryptocurrency Businesses

• Comply with the Cryptocurrency Security Standard.¹⁴

3.4  All Organizations

• Add the listed IOCs in the table below to intrusion detection systems and security alert systems to block and report any suspicious activity.
• Maintain a proper security policy and stay vigilant through official authorities channels and security vendors for any updates regarding this threat actor.

4.  Indicators of Compromise

Below is a list of known IOCs related to this attack.

Indicator	Description
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 A84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 Bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb C0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04	SHA-256 hashes
celasllc[.]com 45[.]199[.]63[.]220 107[.]187[.]66[.]103 145[.]249[.]106[.]19 175[.]29[.]32[.]160 185[.]142[.]236[.]213 185[.]181[.]104[.]82 198[.]251[.]83[.]27 208[.]91[.]197[.]46 209[.]99[.]64[.]18 celasllc[.]com/checkupdate[.]php	AppleJeus Version 1 domain, IP addresses and C&Cs
jmttrading[.]org 45[.]33[.]2[.]79 45[.]33[.]23[.]183 45[.]56[.]79[.]23       45[.]79[.]19[.]196 96[.]126[.]123[.]244 146[.]112[.]61[.]107 184[.]168[.]221[.]40 184[.]168[.]221[.]57 198[.]187[.]29[.]20 198[.]54[.]117[.]197 198[.]54[.]117[.]198 198[.]54[.]117[.]199 198[.]54[.]117[.]200 198[.]58[.]118[.]167 http://beastgoc[.]com/grepmonux[.]php	AppleJeus Version 2 domain, IP addresses and C&Cs
unioncrypto[.]vip 104[.]168[.]167[.]16 198[.]54[.]117[.]197 198[.]54[.]117[.]198 198[.]54[.]117[.]199 198[.]54[.]117[.]200 https://www[.]unioncrypto[.]vip/download/W6c2dq8By7luMhCmya2v97YeN https://unioncrypto[.]vip/update	AppleJeus Version 3 domain, IP addresses and C&Cs
01c13f825ec6366ac2b6dd80e5589568fa5c8685cb4d924d1408e3d7c178902f (UnionCryptoUpdater.exe) 0967d2f122a797661c90bc4fc00d23b4a29f66129611b4aa76f62d8a15854d36 (UnionCryptoTrader.exe) 2ab58b7ce583402bf4cbc90bee643ba5f9503461f91574845264d4f7e3ccb390 (UnionCryptoTrader.dmg) 631ac269925bb72b5ad8f469062309541e1edfec5610a21eecded75a35e65680 (unioncryptoupdater) 6f45a004ad6bb087f733feb618e115fe88164f6db9562cb9b428372c9add75f0 (UnionCryptoTrader) 755bd7a3765efceb8183ffade090ef2637a85c4505f8078dda116013dd5758f3 (NodeDLL.dll) af4144c1f0236e6b59f40d88635ec54c2ef8034f6a96a83f5dbfd6b8ea2c0d49 (UnionCryptoTrader.msi) e3623c2440b692f6b557a862719dc95f41d2e9ad7b560e837d3b59bfe4b8b774 (UnionCryptoSetup.exe)	AppleJeus Version 3 file hashes
kupaywallet[.]com 104[.]200[.]67[.]96 https://kupaywallet[.]com/kupay_update.php	AppleJeus Version 4 domain, IP addresses and C&C
0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba (kupay_upgrade) 1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6 (Kupay.exe) 91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd (kupayupdate_stage2) a0c461c94ba9f1573c7253666d218b3343d24bfa5d8ef270ee9bc74b7856e492 (kupay) fc1aafd2ed190fa523e60c3d22b6f7ca049d97fc41c9a2fe987576d6b5e81d6d (KupayUpgrade.exe)	AppleJeus Version 4 file hashes
coinGoTrade[.]com 198.54.114[.]175 https://airbseeker[.]com/rediret[.]php https://globalkeystroke[.]com/pockbackx[.]php https://www[.]woodmate[.]it/administrator/help/en-GB/bins/tags/taghelper[.]php 23[.]152[.]0[.]101	AppleJeus Version 5 domain, IP addresses and C&Cs
326d7836d580c08cf4b5e587434f6e5011ebf2284bbf3e7c083a8f41dac36ddd (CoinGoTradeUpgradeDaemon) 3e5442440aea07229a1bf6ca2fdf78c5e2e5eaac312a325ccb49d45da14f97f4 (CoinGoTrade.exe) 527792dfab79f026eaa6930d2109c93e816ed31826dba0338a9223db71aced18 (CoinGo_Trade) 572a124f5665be68eaa472590f3ba75bf34b0ea2942b5fcbfd3e74654202dd09 (CoinGoTradeUpdate.exe) 5e40d106977017b1ed235419b1e59ff090e1f43ac57da1bb5d80d66ae53b1df8 (prtspool)	AppleJeus Version 5 file hashes
dorusio[.]com 198[.]54[.]115[.]51	AppleJeus Version 6 domain and IP addresses
21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831 (DorusioUpgrade.exe) 78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f (Dorusio.exe) a0c461c94ba9f1573c7253666d218b3343d24bfa5d8ef270ee9bc74b7856e492 (Dorusio) dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61 (dorusio_upgrade)	AppleJeus Version 6 file hashes
ants2whale[.]com 198[.]54[.]114[.]237	AppleJeus Version 7 domain and IP addresses
bb430087484c1f4587c54efc75681eb60cf70956ef2a999a75ce7b563b8bd694 (Ants2WhaleHelper) d5ac680e14b013e0624470da7f46e84809d00b59a7544f6a42b110cf0e29254e (Ants2Whale)	AppleJeus Version 7 file hashes

Endnotes

1. https://us-cert.cisa.gov/ncas/alerts/aa21-048a
2. https://www.infoblox.com/wp-content/uploads/threat-intelligence-report-hidden-cobra.pdf
3. https://securelist.com/operation-applejeus/87553/
4. https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048a
5. https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048b
6. https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048c
7. https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048d
8. The alert https://us-cert.cisa.gov/ncas/alerts/aa21-048a gives a discovery timeframe of “early 2020;” however, the report https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048e lists the discovery timeframe of October 2020.
9. https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048e
10. https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048f
11. https://us-cert.cisa.gov/ncas/analysis-reports/ar21-048f
12. https://us-cert.cisa.gov/contact-us
13. https://ithandbook.ffiec.gov/
14. http://cryptoconsortium.github.io/CCSS/