MAR-10322463-6.v1 - AppleJeus: Dorusio

2021-02-17 • USCISA •

https://www.cisa.gov/news-events/analysis-reports/ar21-048f

Thumbnail for MAR-10322463-6.v1 - AppleJeus: Dorusio

North Korean state-sponsored Lazarus Group actors distributed Dorusio, a Windows and macOS AppleJeus cryptocurrency wallet containing malicious upgrade components. The updaters established persistence, collected basic host information, and contacted `dorusio.com/dorusio_update.php` to retrieve and execute additional payloads. CISA linked the infrastructure to earlier AppleJeus activity and published hashes for the Windows and macOS components.

Indicators of Compromise

Type Value First Seen Last Seen
HASH dcb232409c799f6ddfe4bc0566161c2… 2021-02-17 2021-02-18
HASH 21afaceee5fab15948a5a724222c948… 2021-02-17 2021-02-18
HASH 78b56a1385f2a92f3c9404f71731088… 2021-02-17 2021-02-18
HASH a0c461c94ba9f1573c7253666d218b3… 2021-02-17 2021-02-18
DOMAIN dorusio.com 2021-02-17 2021-02-18
EMAIL [email protected] 2021-02-17 2021-02-17
URL https://dorusio.com/dorusio_upd… 2021-02-17 2021-02-17
IPv4 198.54.115.51 2021-02-17 2021-02-17

Related Actors

Related Reports

2021-02-17 • 90% Match
#AppleJeus #FALLCHILL #HiddenCobra #Lazarus #T1587.001 #T1041 #T1071.001 #T1059.004 #T1027 #T1204.002 #T1566.002 #T1583.006 #T1053.005 #T1583.001 #T1059 #T1059.002 #T1573.001 #T1548 #T1564.001 #T1543.004 #T1588.003 #T1547 #T1573 #T1033 #T1543.003 #T1588.004 #T1053.004 #CelasTradePro #CoinGoTrade #Ants2Whale #Dorusio #JMTTrading #KupayWallet #UnionCryptoTrader
Shares tags: AppleJeus, Lazarus, Dorusio • Shares 2 IOCs • Same author: USCISA • Published within a week
« Back