MAR-10322463-1.v1 - AppleJeus: Celas Trade Pro
2021-02-17 • USCISA •
CISA, the FBI, and the U.S. Treasury attribute the Trojanized Celas Trade Pro cryptocurrency application to North Korean state-sponsored Lazarus Group activity. Windows and macOS installers presented a functional clone of QT Bitcoin Trader while adding an updater that collected host data, contacted celasllc.com, and decrypted returned payloads. The operation ultimately delivered FALLCHILL, a HIDDEN COBRA remote-access Trojan, and used phishing and a professionally presented cryptocurrency website to reach victims.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| DOMAIN | celasllc.com | 2018-08-23 | 2024-03-05 |
| HASH | 08012e68f4f84bba8b74690c379cb0b… | 2018-08-23 | 2021-12-21 |
| HASH | c0c2239138b9bc659b5bddd8f49fa3f… | 2021-02-17 | 2021-02-18 |
| HASH | a84ed8ce714dff76b48b26414de9f04… | 2021-02-17 | 2021-02-18 |
| HASH | d404c0a634cef0d32029286fde8efcc… | 2018-08-23 | 2021-02-18 |
| HASH | 5e54bccbd4d93447e79cda0558b0b30… | 2018-08-15 | 2021-02-18 |
| HASH | bdff852398f174e9eef1db1c2d3fefd… | 2018-08-15 | 2021-02-18 |
| URL | https://celasllc.com/checkupdat… | 2021-02-17 | 2021-02-17 |
| HASH | 6ee19085ad5c17f989616d17ef68041… | 2018-08-23 | 2021-02-17 |
| HASH | 94dfcabd8ba5ca94828cd5a88d6ed488 | 2018-08-23 | 2021-02-17 |
| HASH | abec84286df80704b823e698199d89f7 | 2018-08-23 | 2021-02-17 |
| HASH | 14b6d24873f19332701177208f85e776 | 2018-08-23 | 2021-02-17 |
| IPv4 | 185.142.236.226 | 2018-08-23 | 2021-02-17 |
| IPv4 | 196.38.48.121 | 2018-08-23 | 2021-02-17 |
| IPv4 | 185.142.236.213 | 2018-08-23 | 2021-02-17 |
Related Actors
Related Reports
2021-02-17 •
88% Match
#AppleJeus
#FALLCHILL
#HiddenCobra
#Lazarus
#T1587.001
#T1041
#T1071.001
#T1059.004
#T1027
#T1204.002
#T1566.002
#T1583.006
#T1053.005
#T1583.001
#T1059
#T1059.002
#T1573.001
#T1548
#T1564.001
#T1543.004
#T1588.003
#T1547
#T1573
#T1033
#T1543.003
#T1588.004
#T1053.004
#CelasTradePro
#CoinGoTrade
#Ants2Whale
#Dorusio
#JMTTrading
#KupayWallet
#UnionCryptoTrader
Shares tags: AppleJeus, FALLCHILL, HiddenCobra • Shares 2 IOCs • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, HiddenCobra • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Same author: USCISA • Published within a week