MAR-10322463-6.v1 - AppleJeus: Dorusio

2021-02-17 • USCISA •

https://www.cisa.gov/news-events/analysis-reports/ar21-048f

Thumbnail for MAR-10322463-6.v1 - AppleJeus: Dorusio

North Korean state-sponsored Lazarus Group actors distributed Dorusio, a Windows and macOS AppleJeus cryptocurrency wallet containing malicious upgrade components. The updaters established persistence, collected basic host information, and contacted `dorusio.com/dorusio_update.php` to retrieve and execute additional payloads. CISA linked the infrastructure to earlier AppleJeus activity and published hashes for the Windows and macOS components.

Indicators of Compromise

Type Value First Seen Last Seen
HASH 21afaceee5fab15948a5a724222c948… 2021-02-17 2021-02-18
HASH a0c461c94ba9f1573c7253666d218b3… 2021-02-17 2021-02-18
HASH 78b56a1385f2a92f3c9404f71731088… 2021-02-17 2021-02-18
HASH dcb232409c799f6ddfe4bc0566161c2… 2021-02-17 2021-02-18
DOMAIN dorusio.com 2021-02-17 2021-02-18
EMAIL [email protected] 2021-02-17 2021-02-17
URL https://dorusio.com/dorusio_upd… 2021-02-17 2021-02-17
HASH 7bd98454d2a3fdd9d541dd0547c1f6a… 2021-02-17 2021-02-17
HASH e769a810389f931b748bbe80742c427… 2021-02-17 2021-02-17
HASH d620c699a5b1828aca699b5aee77e5e6 2021-02-17 2021-02-17
HASH 3362ef6d9c24814972c9b59f2e0b57b… 2021-02-17 2021-02-17
HASH 7e64fb8ec24361406ed685719d8dedc… 2021-02-17 2021-02-17
HASH 0f39312e8eb5702647664e9ae8502ceb 2021-02-17 2021-02-17
HASH e9e72322983315d7a99e104b0a36e63… 2021-02-17 2021-02-17
HASH 69eb27395e8f23b592547b69fbaf19a… 2021-02-17 2021-02-17
HASH 6c36c8efe2ec2b12f343537d214f45e8 2021-02-17 2021-02-17
HASH 51d37b27f390bc7f124f2cb8efb2b9c… 2021-02-17 2021-02-17
HASH 438243575764a5e856951126674f72f… 2021-02-17 2021-02-17
HASH 4a43bafb4af0a038a7f430417bcc1b6e 2021-02-17 2021-02-17
IPv4 198.54.115.51 2021-02-17 2021-02-17

Related Actors

Related Reports

« Back