AppleJeus

The email provided a link to the Celas’ website, celasllc[.]com ( Acquire Infrastructure: Domain [T1583.001])... Again, the malware was ... distributed on their website, jmttrading[.]org ( Acquire Infrastructure: Domain [T1583.001]).

This website contained a “Download from GitHub” button, which linked to JMT Trading’s GitHub page ( Acquire Infrastructure: Web Services [T1583.006]).

FALLCHILL typically infects a system as a file dropped by other HIDDEN COBRA malware ( Develop Capabilities: Malware [T1587.001]).

The installer looks legitimate and is signed by a valid Sectigo certificate ... ( Obtain Capabilities: Code Signing Certificates [T1588.003]).

The celasllc[.]com domain had a valid Sectigo ... SSL certificate ( Obtain Capabilities: Digital Certificates [T1588.004]).

The Justice Department and FBI said in 2021 North Korea has used websites that appeared to host legitimate cryptocurrency trading platforms to infect victims with AppleJeus malware since at least 2018.

Lazarus Group... is targeting individuals and companies, including cryptocurrency exchanges and financial service companies, through the dissemination of cryptocurrency trading applications that have been modified to include malware that facilitates theft of cryptocurrency.

"The attackers behind this campaign uploaded several poisoned Python packages to PyPI..." ... "Successful installation of malicious third-party packages can result in malware infection that compromises an entire network."

During the 3CX Supply Chain Attack, AppleJeus first compromised an "end-of-life" trading software application which was downloaded and executed inside the 3CX enterprise environment. The second compromise modified the Windows and macOS build environments used to distribute the 3CX software to their customer base.

Celas Trade Pro had been recommended to the victim company via a phishing email from a company known as Celas Limited.

“This new method uses a malicious Microsoft Office document… The document uses embedded macros to deploy malware on the target system.”

Lazarus Group... is targeting individuals and companies, including cryptocurrency exchanges and financial service companies, through the dissemination of cryptocurrency trading applications that have been modified to include malware... an unsuspecting individual downloads a third-party application from a website that appears legitimate.

there is a postinstall script and a plist file which creates a LaunchDaemon to automatically run the Ants2WhaleHelper program.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

The installer contains a postinstall script... The postinstall script creates a “DorusioDaemon” folder in the OSX “/Library/Application Support” folder and moves "dorusio_upgrade" to it.

Execute a shell command through cmd.exe

“stand ”: this command will execute commands from the server via the shell using the popen API

“The document uses embedded macros… macro split into two parts… decode a base64 blob… containing… a second macro.”

“the malware expects the response to contain shellcode to execute.”

has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails... has required user execution of a malicious MSI installer... has been executed through user installation of an executable disguised as a flash installer.

has used malicious files including VBS, LNK, and HTML for execution... has sent malicious files requiring direct victim interaction to execute... has used malicious .exe or .dll files disguised as documents or images.

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory. Astaroth can launch itself via DLL Search Order Hijacking.

The installer contains a postinstall script... This script moves the hidden “.com.celastradepro.plist” file from the installer package to the LaunchDaemons folder.

there is a postinstall script and a plist file which creates a LaunchDaemon to automatically run the Ants2WhaleHelper program.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

When executed, "UnionCryptoUpdater.exe" first installs itself as a service, which will automatically start when any user logs on.

CoinGoTrade placed the plist file (com.coingotrade.pkg.product.plist) in “/Library/LaunchDaemons/.”

The program UnionCryptoUpdater.exe first installs itself as a service ... which will automatically start when any user logs on ( Boot or Logon Autostart Execution [T1547]).

The installer contains a postinstall script... This script moves the hidden “.com.celastradepro.plist” file from the installer package to the LaunchDaemons folder.

there is a postinstall script and a plist file which creates a LaunchDaemon to automatically run the Ants2WhaleHelper program.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

Annotations ID Technique Tactic T1055 Process Injection Privilege Escalation

When executed, "UnionCryptoUpdater.exe" first installs itself as a service, which will automatically start when any user logs on.

CoinGoTrade placed the plist file (com.coingotrade.pkg.product.plist) in “/Library/LaunchDaemons/.”

The program UnionCryptoUpdater.exe first installs itself as a service ... which will automatically start when any user logs on ( Boot or Logon Autostart Execution [T1547]).

Once permission is granted, the threat actor is able to run the program with elevated privileges ( Abuse Elevation Control Mechanism [T1548]).

The content repeatedly describes malware and threat actors that 'bypass UAC,' 'perform UAC bypass,' or use specific Windows components such as fodhelper.exe, eventvwr.exe, sdclt.exe, CMSTPLUA COM interface, SilentCleanup, and registry hijacks to gain elevated privileges.

All important API calls have been base64 encoded and RC4 encrypted which will be decoded and decrypted at run time.

Metamorfo has used YouTube to store and hide C&C server domains.

Examples throughout the content include 'encrypted payloads decrypted and executed in memory,' 'encrypts its configuration file,' 'AES-encrypted resource,' 'RC4 encrypted embedded scripts,' and 'payload includes an encrypted main component.'

the malware appears to be from a legitimate-looking cryptocurrency trading company and website, whereby an unsuspecting individual downloads a third-party application from a website that appears legitimate.

Annotations ID Technique Tactic T1055 Process Injection Privilege Escalation

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

“AppleJeus delivered components using a Windows Installer package (.msi)… executed the 3CXDesktopApp.exe…”, “APT38 has used msiexec.exe to execute malicious files.”, “Rancor has used msiexec to download and execute malicious installer files over HTTP.”, “TA505 has used msiexec to download and execute malicious Windows Installer files.”

This file is hidden because the leading “.” causes it to not be shown to the user if they view the folder in the Finder application.

The content repeatedly describes malware and threat actors creating hidden folders, adding dot prefixes to filenames, and setting file attributes such as hidden/system to conceal files and directories from users and defenders.

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory. Astaroth can launch itself via DLL Search Order Hijacking.

The content repeatedly describes threat actors and malware using valid, stolen, forged, self-signed, or abused code-signing certificates to sign malware and appear legitimate, including examples such as AppleJeus using a valid digital signature from Sectigo, APT41 leveraging code-signing certificates, FIN7 signing Carbanak payloads, and SUNBURST being digitally signed by SolarWinds.

Updater.exe ... collects the victim’s host information ( System Owner/User Discovery [T1033]), encrypts the collected information ... and sends information to a C2 website.

The content repeatedly describes malware and threat actors collecting OS version, computer name, architecture, CPU, memory, disk, language, and other host details; examples include use of commands such as ver, systeminfo, hostname, uname -m, sw_vers -productVersion, and fsutil.

The malware’s capabilities include reading/writing itself to various directories, querying/writing to the registry, searching for files, extract/decode payload, and terminating processes.

BoomBox can encrypt data using AES prior to exfiltration. ROKRAT can encrypt data prior to exfiltration by using an RSA public key. Trojan.Karagany can base64 encode and AES-128-CBC encrypt data prior to transmission.

The malware collects basic victim information and encrypts the data with the hardcoded XOR key... The encrypted data is sent to “hxxps[:]//beastgoc.com/grepmonux.php”

the strings from Ants2Whale reveal the C2 hxxp[:]//45.147.231.77:3000... The C2 for this program is hxxps[:]//www[.]qnalytica.com/wp-rss.php.

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications. | Specific implementations mentioned include 'HTTP POST requests,' 'HTTP GET requests,' 'custom HTTP cookies,' 'Cookie HTTP header,' 'HTTP Upgrade request' for WebSocket initiation, and use of APIs such as 'Microsoft Graph API' or 'Dropbox HTTP API' for C2.

“up”: this command will upload a file from the C2 server to the infected host

"FALLCHILL malware uses an RC4 encryption algorithm... to protect its communications ( Encrypted Channel...)"

"FALLCHILL malware uses an RC4 encryption algorithm... ( Encrypted Channel: Symmetric Cryptography [T1573.001])"

If the POST is successful... but fails any of multiple different checks, "DorusioUpgrade.exe" will sleep for two minutes and then regenerate the timestamp and contact the C2 again.

ADVSTORESHELL exfiltrates data over the same channel used for C2.

Targeting of Cryptocurrency Companies and Theft of Cryptocurrency : Targeting of hundreds of cryptocurrency companies and the theft of tens of millions of dollars’ worth of cryptocurrency, including $75 million from a Slovenian cryptocurrency company in December 2017; $24.9 million from an Indonesian cryptocurrency company in September 2018; and $11.8 million from a financial services company in New York in August 2020 in which the hackers used the malicious CryptoNeuro Trader application as a backdoor.