This Malware Analysis Report (MAR) is the result of analytic efforts among the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) to highlight the cyber threat to cryptocurrency posed by North Korea, formally known as the Democratic People’s Republic of Korea (DPRK), and provide mitigation recommendations. Working with U.S. government partners, FBI, CISA, and Treasury assess that Lazarus Group—which these agencies attribute to North Korean state-sponsored advanced persistent threat (APT) actors—is targeting individuals and companies, including cryptocurrency exchanges and financial service companies, through the dissemination of cryptocurrency trading applications that have been modified to include malware that facilitates theft of cryptocurrency.
This MAR highlights this cyber threat posed by North Korea and provides detailed indicators of compromise (IOCs) used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on other versions of AppleJeus and recommended steps to mitigate this threat, see Joint Cybersecurity Advisory AA21-048A: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware at https://www.us-cert.cisa.gov/ncas/alerts/AA21-048A.
There have been multiple versions of AppleJeus malware discovered since its initial discovery in August 2018. In most versions, the malware appears to be from a legitimate-looking cryptocurrency trading company and website, whereby an unsuspecting individual downloads a third-party application from a website that appears legitimate.
The U.S. Government has identified AppleJeus malware version—Kupay Wallet—and associated IOCs used by the North Korean government in AppleJeus operations.
Kupay Wallet, discovered in March 2020, is a legitimate-looking cryptocurrency trading software that is marketed and distributed by a company and website—Kupay Service and kupaywallet[.]com, respectively—that appear legitimate. Some information has been redacted from this report to preserve victim anonymity.
For a downloadable copy of IOCs, see: MAR-10322463-4.v1.stix.
Submitted Files (7)
0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba (kupay_upgrade)
1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6 (Kupay.exe)
[Redacted] (Kupay.dmg)
[Redacted] (Kupay.msi)
91eaf215be336eae983d069de16630cc3580e222c427f785e0da312d0692d0fd (kupayupdate_stage2)
a0c461c94ba9f1573c7253666d218b3343d24bfa5d8ef270ee9bc74b7856e492 (kupay)
fc1aafd2ed190fa523e60c3d22b6f7ca049d97fc41c9a2fe987576d6b5e81d6d (KupayUpgrade.exe)
Domains (2)
kupaywallet.com
levelframeblog.com
Findings
[Redacted]
Tags
dropper
Details
Name | Kupay.msi |
---|---|
Size | [Redacted] bytes |
Type | Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Number of Words: 2, Subject: Kupay, Author: Kupay Service, Name of Creating Application: Advanced Installer 14.5.2 build 83143, Template: ;1033, Comments: This installer database contains the logic and data required to install Kupay., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200 |
MD5 | [Redacted] |
SHA1 | [Redacted] |
SHA256 | [Redacted] |
SHA512 | [Redacted] |
ssdeep | [Redacted] |
Entropy | [Redacted] |
Antivirus
No matches found.
YARA Rules
No matches found.
ssdeep Matches
No matches found.
Relationships
[Redacted] | Contains | 1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6 |
[Redacted] | Contains | fc1aafd2ed190fa523e60c3d22b6f7ca049d97fc41c9a2fe987576d6b5e81d6d |
[Redacted] | Downloaded_By | kupaywallet.com |
Description
This Windows program from the Kupay Service site is a Windows MSI Installer with the file name Kupay[GUID].msi. The installer was hosted at hxxps[:]kupaywallet.com/product/[GUID]. The [GUID] is a unique file that is crated for a specific victim and is being withheld to preserve the identity of the intended recipient.
The installer looks legitimate and will install the “Kupay.exe” (1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6) file in the “C:\Program Files (x86)\Kupay” folder. It also installs “KupayUpgrade.exe” (fc1aafd2ed190fa523e60c3d22b6f7ca049d97fc41c9a2fe987576d6b5e81d6d) in the “C:\Users\<username>\AppData\Roaming\KupaySupport” folder. Immediately after installation, the installer launches the “KupayUpgrade.exe” binary.
Screenshots
Figure 1 – Screenshot of “Kupay.msi” installation.
kupaywallet.com
Tags
command-and-control
URLs
- kupaywallet.com/kupay_update.php
- kupaywallet.com/product/
Whois
Whois for kupaywallet.com had the following information:
Registrar: NAMECHEAP INC
Creation Date: 2020-02-21
Registrar Registration Expiration Date: 2021-02-21
Relationships
kupaywallet.com | Downloaded | [Redacted] |
kupaywallet.com | Downloaded | [Redacted] |
kupaywallet.com | Connected_From | 0bc7517aa2f0c1820ced399bfd66b993f10ad77e8d72727b0f3dc1ca35cad7ba |
Description
The domain kupaywallet.com had a legitimately signed Sectigo Secure Sockets Layer (SSL) certificate, which was “Domain Control Validated” just as all previous AppleJeus domain certificates. Investigation revealed the point of contact listed for verification was admin[@]kupaywallet.com. No other contact information was available as the administrative or technical contact for the kupaywallet.com domain.
The domain is registered with NameCheap at the IP address 104.200.67.96 with ASN 8100.
In addition to the site kupaywallet.com, a Twitter account @kupayservice is associated with the company. This account tweets out general cryptocurrency articles and information and replies to various related tweets. The first tweet was on May 23, 2019, while the last was on July 11, 2019. Twitter lists the joined date for @kupayservice to be October 2018.
Screenshots
Figure 2 – Screenshot of KupayService Twitter account.
1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6
Tags
trojan
Details
Name | Kupay.exe |
---|---|
Size | 97686016 bytes |
Type | PE32+ executable (GUI) x86-64, for MS Windows |
MD5 | 668d696582f9c00029e2e8253470e9db |
SHA1 | e83ebe43da7bbfb9c95d34163383d1b3926e663f |
SHA256 | 1b60a6d35c872102f535ae6a3d7669fb7d55c43dc7e73354423fdcca01a955d6 |
SHA512 | 0b370636ea2b7211d691a3bfcfc9017cb12df6874becb9b6334ca735bc325f59c50e99fc3b57c8db2d265e0c631651c7280109ffdbb3b48b7d3709d908228de6 |
ssdeep | 1572864:MdJvugr82jf19dUM/1T8+1VJRukUhkmG:Mdhg6Pm |
Entropy | 6.674838 |
Antivirus
No matches found.
YARA Rules
No matches found.
ssdeep Matches
97 | 78b56a1385f2a92f3c9404f71731088646aac6c2c84cc19a449976272dab418f |
---|
PE Metadata
Compile Date | 2019-12-16 00:00:00-05:00 |
---|---|
Import Hash | bb1d46df79ee2045d0bc2529cf6c7458 |
Company Name | BitPay |
File Description | Kupay |
Internal Name | Kupay |
Legal Copyright | Copyright © 2020 BitPay |
Product Name | Kupay |
Product Version | 9.1.0.0 |
PE Sections
MD5 | Name | Raw Size | Entropy |
---|---|---|---|
32b731864b0ff3d1c427c97d582e7897 | header | 1024 | 2.990247 |
36430f041d87935dcb34adde2e7d625d | .text | 78234112 | 6.471421 |
ee7e02e8e2958ff79f25c8fd8b7d33e5 | .rdata | 15596032 | 6.376243 |
65c59271f5c2bab26a7d0838e9f04bcf | .data | 262144 | 3.484705 |
00406f1d9355757d80cbf48242fdf344 | .pdata | 2768896 | 6.805097 |
6a6a225bfe091e65d3f82654179fbc50 | .00cfg | 512 | 0.195869 |
786f587a97128c401be15c90fe059b72 | .rodata | 6144 | 4.219562 |
9efa43af7b1faae15ffbd428d0485819 | .tls | 512 | 0.136464 |
60d3ea61d541c9be2e845d2787fb9574 | CPADinfo | 512 | 0.122276 |
bf619eac0cdf3f68d496ea9344137e8b | prot | 512 | 0.000000 |
85237257867935c227d2f2f39316b12a | .rsrc | 106496 | 4.912524 |
fb3216031225fdb1902888e247009d0c | .reloc | 709120 | 5.476445 |
Packers/Compilers/Cryptors
Microsoft Visual C++ 8.0 (DLL) |
Relationships
1b60a6d35c… | Contained_Within | [Redacted] |
Description
This file is a 64-bit Windows executable contained within the Windows MSI Installer “Kupay.msi.” When executed, “Kupay.exe” loads a legitimate looking cryptocurrency wallet application with no signs of malicious activity. This application appears to be a modification of the open source cryptocurrency wallet Copay, which is distributed by Atlanta based company BitPay. According to their website bitpay.com, “BitPay builds powerful, enterprise-grade tools for crypto acceptance and spending.”
In addition to application appearance being similar, a DNS request for “bitpay.com” is always sent out immediately after a DNS request for “kupaywallet.com” and the company listed in the version information for Kupay is Bitpay.
Lastly, the GitHub “Commit Hash” listed in the Dorusio application “638b2b1” is to a branch of Copay found at hxxps[:]//github.com/flean/copay-1 (Figure 5).
Screenshots
Figure 3 – Screenshot of the Kupay Wallet application.