MAR-10322463-4.v1 - AppleJeus: Kupay Wallet
2021-02-17 • USCISA •
CISA, the FBI, and the U.S. Treasury attributed the Kupay Wallet AppleJeus operation to North Korea's Lazarus Group, which used a legitimate-looking cryptocurrency wallet to target individuals and financial-sector organizations. Windows and macOS installers deployed updater components that established persistence and contacted kupaywallet.com to obtain additional payloads. The analyzed macOS second stage used levelframeblog.com for command and control and supported payload transfer, file operations, and terminal command execution with Base64 and XOR encoding.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| HASH | 91eaf215be336eae983d069de16630c… | 2021-02-17 | 2024-12-27 |
| DOMAIN | levelframeblog.com | 2021-02-17 | 2024-09-09 |
| HASH | 0bc7517aa2f0c1820ced399bfd66b99… | 2021-02-17 | 2021-02-18 |
| HASH | a0c461c94ba9f1573c7253666d218b3… | 2021-02-17 | 2021-02-18 |
| HASH | fc1aafd2ed190fa523e60c3d22b6f7c… | 2021-02-17 | 2021-02-18 |
| HASH | 1b60a6d35c872102f535ae6a3d7669f… | 2021-02-17 | 2021-02-18 |
| DOMAIN | kupaywallet.com | 2021-02-17 | 2021-02-18 |
| IPv4 | 23.152.0.101 | 2021-02-17 | 2021-02-18 |
| [email protected] | 2021-02-17 | 2021-02-17 | |
| URL | https://levelframeblog.com/feli… | 2021-02-17 | 2021-02-17 |
| URL | https://kupaywallet.com/product/ | 2021-02-17 | 2021-02-17 |
| URL | https://kupaywallet.com/kupay_u… | 2021-02-17 | 2021-02-17 |
| HASH | 55eacc25e9eaba5d3f04b6cbcac2e16… | 2021-02-17 | 2021-02-17 |
| HASH | 6b945159b4c816ec5e212ba125eb019… | 2021-02-17 | 2021-02-17 |
| IPv4 | 104.200.67.96 | 2021-02-17 | 2021-02-17 |
Related Actors
Related Reports
2021-02-17 •
85% Match
#AppleJeus
#FALLCHILL
#HiddenCobra
#Lazarus
#T1587.001
#T1041
#T1071.001
#T1059.004
#T1027
#T1204.002
#T1566.002
#T1583.006
#T1053.005
#T1583.001
#T1059
#T1059.002
#T1573.001
#T1548
#T1564.001
#T1543.004
#T1588.003
#T1547
#T1573
#T1033
#T1543.003
#T1588.004
#T1053.004
#CelasTradePro
#CoinGoTrade
#Ants2Whale
#Dorusio
#JMTTrading
#KupayWallet
#UnionCryptoTrader
Shares tags: AppleJeus, Lazarus, KupayWallet • Shares 2 IOCs • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Shares 1 IOC • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Shares 1 IOC • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Same author: USCISA • Published within a week
Shares tags: AppleJeus, macOS, Lazarus • Same author: USCISA • Published within a week