MAR-10322463-5.v1 - AppleJeus: CoinGoTrade
2021-02-17 • USCISA •
The FBI, CISA, and U.S. Treasury attribute CoinGoTrade, an AppleJeus cryptocurrency application, to North Korean state-sponsored Lazarus Group activity. Its Windows and macOS installers delivered legitimate-looking trading software alongside persistent updater components that contacted attacker infrastructure and could retrieve and execute additional payloads. The applications used `23.152.0.101:8080` and `coingotrade.com`, while the suspected macOS second stage also communicated with three additional domains. The second stage supported command execution, file transfer, configuration updates, directory enumeration, network probing, and secure file deletion.
Indicators of Compromise
| Type | Value | First Seen | Last Seen |
|---|---|---|---|
| HASH | 5e40d106977017b1ed235419b1e59ff… | 2021-02-17 | 2025-09-01 |
| DOMAIN | globalkeystroke.com | 2021-02-17 | 2024-09-09 |
| DOMAIN | airbseeker.com | 2021-02-17 | 2024-09-09 |
| DOMAIN | woodmate.it | 2021-02-17 | 2023-10-05 |
| URL | https://globalkeystroke.com/poc… | 2021-02-17 | 2023-10-05 |
| URL | https://airbseeker.com/rediret.… | 2021-02-17 | 2023-10-05 |
| URL | https://www.woodmate.it/adminis… | 2021-02-17 | 2023-10-05 |
| HASH | 527792dfab79f026eaa6930d2109c93… | 2021-02-17 | 2021-02-18 |
| HASH | 572a124f5665be68eaa472590f3ba75… | 2021-02-17 | 2021-02-18 |
| HASH | 3e5442440aea07229a1bf6ca2fdf78c… | 2021-02-17 | 2021-02-18 |
| IPv4 | 23.152.0.101 | 2021-02-17 | 2021-02-18 |
| HASH | 326d7836d580c08cf4b5e587434f6e5… | 2020-07-27 | 2021-02-18 |
| DOMAIN | coingotrade.com | 2020-07-27 | 2021-02-18 |
| [email protected] | 2021-02-17 | 2021-02-17 | |
| [email protected] | 2021-02-17 | 2021-02-17 | |
| URL | https://coingotrade.com/downloa… | 2021-02-17 | 2021-02-17 |
| URL | https://coingotrade.com/coingot… | 2021-02-17 | 2021-02-17 |
| URL | http://23.152.0.101:8080/ | 2021-02-17 | 2021-02-17 |
| URL | https://coingotrade.com/update_… | 2020-07-27 | 2021-02-17 |