This Malware Analysis Report (MAR) is the result of analytic efforts among the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) to highlight the cyber threat to cryptocurrency posed by North Korea, formally known as the Democratic People’s Republic of Korea (DPRK), and provide mitigation recommendations. Working with U.S. government partners, FBI, CISA, and Treasury assess that Lazarus Group—which these agencies attribute to North Korean state-sponsored advanced persistent threat (APT) actors—is targeting individuals and companies, including cryptocurrency exchanges and financial service companies, through the dissemination of cryptocurrency trading applications that have been modified to include malware that facilitates theft of cryptocurrency.
This MAR highlights this cyber threat posed by North Korea and provides detailed indicators of compromise (IOCs) used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on other versions of AppleJeus and recommended steps to mitigate this threat, see Joint Cybersecurity Advisory AA21-048A: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware at https://www.us-cert.cisa.gov/ncas/alerts/AA21-048A.
There have been multiple versions of AppleJeus malware discovered since its initial discovery in August 2018. In most versions, the malware appears to be from a legitimate-looking cryptocurrency trading company and website, whereby an unsuspecting individual downloads a third-party application from a website that appears legitimate.
The U.S. Government has identified AppleJeus malware version—Dorusio—and associated IOCs used by the North Korean government in AppleJeus operations. Some information has been redacted from this report to preserve victim anonymity.
Dorusio, discovered in March 2020, is a legitimate-looking cryptocurrency trading software that is marketed and distributed by a company and website— Dorusio Wallet and dorusio[.]com, respectively—that appear legitimate. There are Windows and OSX versions of Dorusio Wallet. As of at least early 2020, the actual download links result in 404 errors. The download page has release notes with version revisions claiming to start with Version 1.0.0, which was released on April 15, 2019.
For a downloadable copy of IOCs, see: MAR-10322463-6.v1.stix.
Submitted Files (6)
[Redacted] (dorusio_osx_v2.1.0.dmg)
21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831 (DorusioUpgrade.exe)
[Redacted] (dorusio_win_v2.1.0.msi)
78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f (Dorusio.exe)
a0c461c94ba9f1573c7253666d218b3343d24bfa5d8ef270ee9bc74b7856e492 (Dorusio)
dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61 (dorusio_upgrade)
Domains (1)
dorusio.com
Findings
[Redacted]
Tags
droppertrojan
Details
| Name | dorusio_win_v2.1.0.msi |
|---|---|
| Size | 141426176 bytes |
| Type | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Number of Words: 2, Subject: Dorusio, Author: Dorusio Service Ltd, Name of Creating Application: Advanced Installer 14.5.2 build 83143, Template: ;1033, Comments: This installer database contains the logic and data required to install Dorusio., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 |
| MD5 | [Redacted] |
| SHA1 | [Redacted] |
| SHA256 | [Redacted] |
| SHA512 | [Redacted] |
| ssdeep | [Redacted] |
| Entropy | [Redacted] |
Antivirus
No matches found.
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
| [Redacted] | Downloaded_By | dorusio.com |
| [Redacted] | Contains | 78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f |
| [Redacted] | Contains | 21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831 |
Description
This Windows program from the Dorusio Wallet site is a Windows MSI Installer. This installer appears to be legitimate and will install “Dorusio.exe” (78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f) in the “C:\Program Files (x86)\Dorusio” folder. It will also install “DorusioUpgrade.exe” (21afaceee5fab15948a5a724222c948ad17cad181bf514a680267abcce186831) in the “C:\Users\<username>\AppData\Roaming\DorusioSupport” folder. Immediately after installation, the installer launches “DorusioUpgrade.exe.” During installation, a Dorusio folder containing the “Dorusio.exe” application is added to the start menu.
Screenshots
Figure 1 – Screenshot of the Dorusio Wallet installation.
dorusio.com
Tags
command-and-control
URLs
- dorusio.com/dorusio_update.php
Whois
Whois for dorusio.com had the following information:
Registrar: NAMECHEAP INC
Creation Date: 2020-03-30
Registrar Registration Expiration Date: 2021-03-30
Relationships
| dorusio.com | Connected_From | dcb232409c799f6ddfe4bc0566161c2d0b372db6095a0018e6059e34c2b79c61 |
| dorusio.com | Downloaded | [Redacted] |
| dorusio.com | Downloaded | [Redacted] |
Description
The domain “dorusio.com” had a legitimately signed Sectigo SSL certificate, which was “Domain Control Validated” similar to the domain certificates for previous AppleJeus domain certificates. Investigation revealed the point of contact listed for verification was support[@]dorusio.com. No other contact information was available as the administrative or technical contact for the domain.
The domain is registered with NameCheap at the IP address 198.54.115.51 with ASN 22612. This IP is on the same ASN as the AppleJeus version 5 “CoinGoTrade” IP address.
Screenshots
Figure 2 – Screenshot of the Dorusio site.
Figure 3 – Screenshot of the Dorusio download page.
78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f
Tags
trojan
Details
| Name | Dorusio.exe |
|---|---|
| Size | 97682432 bytes |
| Type | PE32+ executable (GUI) x86-64, for MS Windows |
| MD5 | 6c36c8efe2ec2b12f343537d214f45e8 |
| SHA1 | 69eb27395e8f23b592547b69fbaf19ad03d6a89a |
| SHA256 | 78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f |
| SHA512 | e9e72322983315d7a99e104b0a36e6301b7c78b3e93fc33c03e2e74ea1d5423b852a23a87a8ecaadf33f73ceb03b306d953b197a13542ae436c6b039ec1c00a7 |
| ssdeep | 1572864:odJvugr82jf19dUM/1T8+1VJRukUhkmG:odhg6Pm |
| Entropy | 6.674758 |
Antivirus
No matches found.
YARA Rules
No matches found.
ssdeep Matches
| 97 | 1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6 |
|---|
PE Metadata
| Compile Date | 2019-12-16 00:00:00-05:00 |
|---|---|
| Import Hash | bb1d46df79ee2045d0bc2529cf6c7458 |
| Company Name | BitPay |
| File Description | Dorusio |
| Internal Name | Dorusio |
| Legal Copyright | Copyright © 2020 BitPay |
| Product Name | Dorusio |
| Product Version | 2.1.0.0 |
PE Sections
| MD5 | Name | Raw Size | Entropy |
|---|---|---|---|
| f62420692d3492b34a0696beb92d52dc | header | 1024 | 2.991122 |
| 36430f041d87935dcb34adde2e7d625d | .text | 78234112 | 6.471421 |
| ee7e02e8e2958ff79f25c8fd8b7d33e5 | .rdata | 15596032 | 6.376243 |
| 65c59271f5c2bab26a7d0838e9f04bcf | .data | 262144 | 3.484705 |
| 00406f1d9355757d80cbf48242fdf344 | .pdata | 2768896 | 6.805097 |
| 6a6a225bfe091e65d3f82654179fbc50 | .00cfg | 512 | 0.195869 |
| 786f587a97128c401be15c90fe059b72 | .rodata | 6144 | 4.219562 |
| 9efa43af7b1faae15ffbd428d0485819 | .tls | 512 | 0.136464 |
| 60d3ea61d541c9be2e845d2787fb9574 | CPADinfo | 512 | 0.122276 |
| bf619eac0cdf3f68d496ea9344137e8b | prot | 512 | 0.000000 |
| fb5463e289f28642cc816a9010f32981 | .rsrc | 102912 | 4.766115 |
| fb3216031225fdb1902888e247009d0c | .reloc | 709120 | 5.476445 |
Packers/Compilers/Cryptors
| Microsoft Visual C++ 8.0 (DLL) |
Relationships
| 78b56a1385… | Contained_Within | [Redacted] |
Description
This file is a 64-bit Windows executable contained within the Windows MSI Installer “dorusio_win_v2.1.0.msi.” When executed, “Dorusio.exe” loads a legitimate looking cryptocurrency wallet application with no signs of malicious activity. Aside from the “Dorusio” logo and two new services, the wallet appears to be the same as the AppleJeus version 4 “Kupay wallet.”
This application appears to be a modification of the opensource cryptocurrency wallet Copay, which is distributed by Atlanta based company BitPay. According to the website “bitpay.com,” “BitPay builds powerful, enterprise-grade tools for crypto acceptance and spending”.
In addition to application appearance being similar, a DNS request for “bitpay.com” is always sent out immediately after a DNS request for “dorusio.com” and the company listed for “Dorusio” is Bitpay.
In addition, the GitHub “Commit Hash” listed in the “Dorusio” application “638b2b1” is to a branch of Copay found at hxxps[:]//github.com/flean/copay-1.
Screenshots
Figure 4 – Screenshot of the Dorusio application.