Original release date: February 17, 2021

Malware Analysis Report

10322463.r1.v1

2021-02-12

Notification

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE–Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.

Summary

Description

This Malware Analysis Report (MAR) is the result of analytic efforts among the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) to highlight the cyber threat to cryptocurrency posed by North Korea, formally known as the Democratic People’s Republic of Korea (DPRK), and provide mitigation recommendations. Working with U.S. government partners, FBI, CISA, and Treasury assess that Lazarus Group—which these agencies attribute to North Korean state-sponsored advanced persistent threat (APT) actors—is targeting individuals and companies, including cryptocurrency exchanges and financial service companies, through the dissemination of cryptocurrency trading applications that have been modified to include malware that facilitates theft of cryptocurrency.

This MAR highlights this cyber threat posed by North Korea and provides detailed indicators of compromise (IOCs) used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on other versions of AppleJeus and recommended steps to mitigate this threat, see Joint Cybersecurity Advisory AA21-048A: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware at https://www.us-cert.cisa.gov/ncas/alerts/AA21-048A.

There have been multiple versions of AppleJeus malware discovered since its initial discovery in August 2018. In most versions, the malware appears to be from a legitimate-looking cryptocurrency trading company and website, whereby an unsuspecting individual downloads a third-party application from a website that appears legitimate.

The U.S. Government has identified AppleJeus malware version—Celas Trade Pro—and associated IOCs used by the North Korean government in AppleJeus operations.

In August 2018, open source reporting revealed information about a Trojanized version of a legitimate cryptocurrency trading application on a victim’s computer (Note: identity of the victim was not disclosed). The malicious program, known as Celas Trade Pro, is a modified version of the benign QT Bitcoin Trader application. This incident led to the victim company being infected with the malware known to the U.S. Government as FALLCHILL, a North Korean remote administration tool (RAT). According to CISA, FALLCHILL “is a fully functional RAT with multiple commands that the actors can issue from a command and control (C2) server to a victim’s system via dual proxies. FALLCHILL typically infects a system as a file dropped by other HIDDENCOBRA malware. Because of this, additional HIDDENCOBRA malware may be present on systems compromised with FALLCHILL.”

Celas Trade Pro had been recommended to the victim company via a phishing email from a company known as Celas Limited. The email provided a link to the Celas Limited website (https://www[.]celasllc.com), where the user could download a Windows or MacOS version of the Celas Trade Pro software.

 

For a downloadable copy of IOCs, see: MAR-10322463-1.v1.stix.

Submitted Files (6)

5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 (Updater)

6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 (celastradepro_win_installer_1….)

a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 (CelasTradePro.exe)

bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb (Updater.exe)

c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 (CelasTradePro)

d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 (celastradepro_mac_installer_1….)

Domains (1)

celasllc.com

Findings

6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

Tags

droppertrojan

Details

Name
celastradepro_win_installer_1.00.00.msi

Size
9827840 bytes

Type
Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {A3B40756-2C9C-4167-9296-5DD2DAF7973E}, Number of Words: 2, Subject: CelasTradePro, Author: CELAS LLC, Name of Creating Application: Advanced Installer 14.5.2 build 83143, Template: ;1033, Comments: This installer database contains the logic and data required to install CelasTradePro., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200

MD5
9e740241ca2acdc79f30ad2c3f50990a

SHA1
0c5e4cec03d2eea2b1dd5356fe05de64a0278cd6

SHA256
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

SHA512
dd02c1e717c2556b64d261f04c5a8add7dcc2f3ad267507d883ba68c7e4cf827136edce517aab055dfa02d8569a5779eb1fc24fb0b7c6bb3447d45e2802726e5

ssdeep
196608:s80YaAWH7ICcfRLdq81w920W+ZP6g2DsjW1TIZfxgNu1DZNJQfIYizTrh50:sPUWHECcfBdR1w9NWqSg2DsK1TmfxgiD

Entropy
7.973409

Antivirus

Ahnlab
MSI/Installer

Comodo
Malware

Microsoft Security Essentials
Trojan:Win32/Letdater

Quick Heal
OLE.MSI.Agent.39994.GC

Sophos
Troj/NukeSped-X

Symantec
Trojan.Dropper

TrendMicro
Trojan.BC27BA50

TrendMicro House Call
Trojan.BC27BA50

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

6ee19085ad…
Downloaded_From
celasllc.com

6ee19085ad…
Contains
a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765

6ee19085ad…
Contains
bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb

Description

This Windows program from the Celas LLC site is a Windows MSI Installer. The installer looks legitimate and previously had a valid digital signature from Comodo (Sectigo). The signature was signed with a code signing certificate purchased by the same user as the Secure Sockets Layer (SSL) certificate for “celasllc.com.” The installer asks for administrative privileges to run and while installing “CelasTradePro.exe” (a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765) it also installs “Updater.exe” in the “C:Program Files (x86)CelasTradePro” folder. Immediately after installation, the installer launches “Updater.exe” (bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb) with the “CheckUpdate” parameter.

Screenshots

Figure 1 – Screenshot of the CelasTradePro installation.

celasllc.com

Tags

command-and-control

URLs

celasllc.com/checkupdate.php

Whois

Whois for celasllc.com had the following information in August 2018:
IP Address: 185.142.236.213
Registrant Name: John Broox
Registrant Organization:
Registrant Street: 2141 S Archer Ave
Registrant City: Chicago
Registrant State/Province: Illinois
Registrant Postal Code: 60601
Registrant Country: US
Registrant Phone: +1.8133205751
Registrant Email: johnbroox200@gmail.com
Name server: 1a7ea920.bitcoin-dns.hosting
Name Server: a8332f3a.bitcoin-dns.hosting
Name Server: ad636824.bitcoin-dns.hosting
Name Server: c358ea2d.bitcoin-dns.hosting
Created: May 29, 2018
Expires: May 29, 2019
Updated: Sep 9, 2018

Relationships

celasllc.com
Downloaded_To
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

celasllc.com
Downloaded_To
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

Description

The Celas Limited website had a professional appearance, and at the time had a valid Secure Sockets Layer (SSL) certificate issued by Comodo (now Sectigo). The SSL certificate was “Domain Control Validated,” which is a weak security verification level for a webserver. Typically, this is a fully automated verification where the certificate requester only needs to demonstrate control over the domain name (i.e. with an email like admin[@]celasllc.com). This type of certificate necessitates no validation of the identity of the website’s owner, nor the existence of the actual business. At the time of analysis, the domain celasllc.com resolved to IP address 185.142.236.213, which belongs to the Netherlands Amsterdam Blackhost Ltd ISP, AS174, Cogent Communications.

Screenshots

Figure 2 – Screenshot of the Celas LLC website.

a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765

Tags

trojan

Details

Name
CelasTradePro.exe

Size
2517160 bytes

Type
PE32 executable (GUI) Intel 80386, for MS Windows

MD5
45eb8f06c5f732e8dde8e9318d8b2392

SHA1
d4583cba9034a3068f8106b5013d37d7bdd46f38

SHA256
a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765

SHA512
6536a7b0767828bb95f6f33a4e465fec48fc474b4f919bc878e02966f82f900fbaa6e2f9d7bc1dffa28bbe35f94ee6b9a570902843dfd35a8c9d1405ac130039

ssdeep
49152:TrxfUhMyK0lq3Z8SC8Q1ZZmpwi0qEdz+7WGSVOr:PxfU60lqiV1UL

Entropy
6.852284

Antivirus

Sophos
Mal/BadCert-Gen

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

Compile Date
2018-06-17 20:17:48-04:00

Import Hash
33ef6aff05b44076249d6ed27e247e11

Company Name
Celas LLC

File Description
Celas Bitcoin Trader

Internal Name
Celas Bitcoin Trader

Legal Copyright
Copyright (C) 2018 CELAS LLC

Original Filename
CelasTradePro.exe

Product Name
CelasTradePro

Product Version
1.0.0.0

PE Sections

MD5
Name
Raw Size
Entropy

724cd82da1ca0a93b9d171923d149ce9
header
1024
2.738571

4909abcdca48f01dd7d44d7b6035deef
.text
1152000
6.244241

88f7c98251537ffd1f94935b8c134b9a
.rdata
1076224
6.842683

0e102f466e9e6893970e2fd96c8b3fce
.data
9728
4.517533

87a4b3b57b1b37d19870a4f1c9577374
.rsrc
110592
3.737298

a6d8c9855dc4334bb35c95a1e0518a9d
.reloc
162304
6.385957

Packers/Compilers/Cryptors

Microsoft Visual C++ ?.?

Relationships

a84ed8ce71…
Contained_Within
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

Description

This file is a 32-bit Windows executable contained within the Windows MSI Installer “celastradepro_win_installer_1.00.00.msi.” When executed, “CelasTradePro.exe” asks for the user’s exchange and then loads a legitimate cryptocurrency trading platform with no signs of malicious activity.

CelasTradePro is extremely similar in appearance to a version of an open source cryptocurrency trading platform available around the same timeframe known as QT Bitcoin Trader (screenshots 3 and 4). In addition to similar appearance, many strings found in CelasTradePro have QT Bitcoin Trader references and parameters being set to “Celas Trade Pro” including but not limited to:

–Begin similarities–
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro
QtBitcoinTrader
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro is a free Open Source project developed on pure C++ Qt and OpenSSL.
julyighor@gmail.com (note: Ighor July is one of the developers of QT Bitcoin Trader)
–End similarities–

The strings also reference the name “John Broox” as the author of CelasTradePro.

While the CelasTradePro application is likely a modification of QT Bitcoin Trader, the legitimate QT Bitcoin Trader for Windows is not available for download as an MSI, but only as a Windows portable executable. This is a singular file named “QtBitcoinTrader.exe” and does not install or run any additional programs. The CelasTradePro MSI contains “CelasTradePro.exe,” the modified version of QT Bitcoin Trader, as well as the additional “Updater.exe” (bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb) executable not included with the original QT Bitcoin Trader.

Screenshots

Figure 3 – Screenshot of the CelasTradePro application.

Figure 4 – Screenshot of the QT Bitcoin Trader application.

bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb

Tags

downloaderloaderspywaretrojan

Details

Name
Updater.exe

Size
173224 bytes

Type
PE32 executable (GUI) Intel 80386, for MS Windows

MD5
b054a7382adf6b774b15f52d971f3799

SHA1
b4d43cd2d81d17dec523915c0fc61b4b29e62c58

SHA256
bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb

SHA512
7c307a2ed0e6e483a0f3e7161ff0433e6bd498ab0b14b5359a938554999b076c4143a766b96c05dc0b949948cac97d81534ceb1300d02276ec90e2c1162383a9

ssdeep
1536:XN9cIi98pUYi7tIP+arPg1ssvpoOJwtFT6BxdYIHs/5mBS0LiF:99clzLPPBoOJwWBxdYlxySr

Entropy
4.980364

Antivirus

Ahnlab
Malware/Win32.Generic

Antiy
Trojan[Downloader]/Win32.Agent

Avira
TR/Dldr.Agent.jlhae

BitDefender
Trojan.GenericKD.40404380

ClamAV
Win.Spyware.Fallchill-6663754-2

Comodo
Malware

ESET
Win32/TrojanDownloader.NukeSped.E trojan

Emsisoft
Trojan.GenericKD.40404380 (B)

Ikarus
Trojan-Downloader.Agent

K7
Riskware ( 0040eff71 )

Lavasoft
Trojan.GenericKD.40404380

McAfee
Generic trojan.d

Microsoft Security Essentials
Trojan:Win32/Letdater

NANOAV
Trojan.Win32.Letscool.fflqoo

Sophos
Troj/NukeSped-Y

Symantec
Trojan Horse

Systweak
trojan.agent

TrendMicro
Trojan.BC27BA50

TrendMicro House Call
Trojan.BC27BA50

VirusBlokAda
TrojanDownloader.Agent

Zillya!
Downloader.Agent.Win32.365188

YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata

Compile Date
2018-06-15 06:56:27-04:00

Import Hash
b25cd98650edb58a9a4d00af1d17453d

PE Sections

MD5
Name
Raw Size
Entropy

2c879beba343ce37c06647fb37be983e
header
1024
2.572659

4da943f482631027a2152c6f336055af
.text
38912
6.556738

0b7c67c806051953aa6addc2771a20eb
.rdata
10240
4.875590

49f73fd786fe23fbc68635fbf76b63a3
.data
4096
2.272665

7a96caced6b43d719b90f6e332ad12f3
.rsrc
109568
3.715817

8aacf0cff202d7d74c04f938df61e45f
.reloc
4096
4.127553

Packers/Compilers/Cryptors

Microsoft Visual C++ ?.?

Relationships

bdff852398…
Contained_Within
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

Description

This file is a 32-bit Windows executable contained within the Windows MSI Installer “celastradepro_win_installer_1.00.00.msi.” “Updater.exe” has the same program icon as CelasTradePro. Updater.exe was likely developed under the name “jeus” based on the build path “Z:jeusdownloaderdownloader_exe_vs2010Releasedloader.pdb” found in the code (partial origin of the name AppleJeus).

“Updater.exe” collects victim host information and sends it back to the server. At launch the malware first checks for the “CheckUpdate” parameter and if not found, exits the program. This is likely to evade detection in a sandbox environment. If the “CheckUpdate” parameter is found, the malware creates a unique identifier for the system following the format “%09d-%05d.” It then collects process lists excluding the “System” processes and queries the registry at “HKLMSOFTWAREMicrosoftWindow NTCurrentVersion” for the following values:

–Begin values–
ProductName (Windows OS Version)
CurrentBuildNumber (Windows 10 build version)
ReleaseID (Windows 10 version information)
UBR (Sub version of Windows 10 build)
BuildBranch (Windows 10 build branch information)
–End values–

After collecting this information, “Updater.exe” encrypts the data with the hard-coded XOR key “Moz&Wie;#t/6T!2y,” prepends the encrypted data with “GIF89a” (image header) and sends the data to “celasllc.com/checkupdate.php.”

The malware also uses a hard-coded User-Agent string “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0” and multipart form data separator “jeus.” If the malware receives a response with HTTP code 200, it will decode the base64 payload, then decrypt the result using the hard-coded RC4 decryption key “W29ab@ad%Df324V$Yd.” The raw data is then written to a file prepended with the “MAX_PATHjeusD” string.

Screenshots

Figure 5 – Screenshot of the “CheckUpdate” parameter verification in “Updater.exe.”

Figure 6 – Hard-coded XOR key and XOR encryption in “Updater.exe.”

d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

Tags

downloaderdropperloadertrojan

Details

Name
celastradepro_mac_installer_1.00.00.dmg

Size
15020544 bytes

Type
DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 1, 29336 sectors, extended partition table (last)

MD5
48ded52752de9f9b73c6bf9ae81cb429

SHA1
1e8a2f1f751e5a9931bca5710b4f304798d665dc

SHA256
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

SHA512
4c4e4445638ace360c82be741e634601bd1beaf980cdc02523484cc7f161b57015f325708ce72d9a2496f3b5bf2d05df5133aee0d1c375b76b23e6a660436d0f

ssdeep
393216:0naJ/9SL/uXRs1q5wxrCAveZZXFdklxkBSY6bzLZaM:bJ/9SLQRwqSrCAS5klxPY6bXZx

Entropy
7.710370

Antivirus

Antiy
Trojan/OSX.Lazarus

Avira
OSX/Lazarus.A

Comodo
Malware

ESET
OSX/TrojanDownloader.NukeSped.A trojan

Ikarus
Trojan.OSX.Lazarus

McAfee
OSX/Lazarus.a

Symantec
OSX.Dropper

TrendMicro
OSX_APPLEJEUS.A

TrendMicro House Call
OSX_APPLEJEUS.A

Vir.IT eXplorer
OSX.Lazarus.ASM

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

d404c0a634…
Downloaded_From
celasllc.com

d404c0a634…
Contains
c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70

d404c0a634…
Contains
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0

Description

This OSX program from the Celas LLC site is an Apple DMG Installer. The OSX program has very similar functionality to the Windows program and also previously had a valid digital signature from Comodo. Again the installer appears to be legitimate, and installs CelasTradePro as well as a program named “Updater” in the “/Applications/CelasTradePro.app/Contents/MacOS/” folder. The installer contains a postinstall script (see figure 6).

A postinstall script is a sequence of instructions which runs after the successful installation of an OSX application. This script moves the hidden “.com.celastradepro.plist” file from the installer package to the LaunchDaemons folder. This file is hidden because the leading “.” causes it to not be shown to the user if they view the folder in the Finder application. Once in the LaunchDaemons folder, this plist file will be ran on system load as root for every user. This will launch the Updater program with the CheckUpdate parameter.

As the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script then launches the Updater program with the CheckUpdate parameter and runs it in the background (&). The package also has “Developed by John Broox. CELAS LLC” in the Info.plist properties file.

Screenshots

Figure 7 – Screenshot of the postinstall script included in OSX Celas installer.

Figure 8 – Screenshot of the “com.celastradepro.plist” file.

c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70

Tags

trojan

Details

Name
CelasTradePro

Size
3544560 bytes

Type
Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>

MD5
4eedb2df53597a15fd48b726d85517f0

SHA1
a60ece7673fa415abe1fb97ac60e19ee446858b1

SHA256
c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70

SHA512
853c85760576919bc59aee901663057a0bfd5a286345cc7464f61e7bdfdebfeb2148401597ae037bbf052c052112cb37c34924b2876383c920d17b908f0e3a85

ssdeep
49152:bvzxIgxauUDh0Dh6jQIRfzOQo14GNoiZPw6YBoOBzRK8IA1LGqBKta9w35wwlRoJ:3xuwhRIR2LPZPwX1vbL9BgwseMzio

Entropy
6.559908

Antivirus

Ahnlab
OSX/Agent.3544560

Antiy
Trojan/OSX.Lazarus

Avira
OSX/Lazarus.dplva

BitDefender
Trojan.MAC.Lazarus.B

ClamAV
Osx.Malware.Agent-7408161-0

ESET
a variant of Generik.IWGLIQC trojan

Emsisoft
Trojan.MAC.Lazarus.B (B)

Ikarus
OSX.Lazarus

Lavasoft
Trojan.MAC.Lazarus.B

McAfee
OSX/Lazarus.f

Sophos
OSX/Lazarus-D

Symantec
OSX.Malcol.2

Zillya!
Trojan.MAC.OSX.89

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

c0c2239138…
Contained_Within
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

Description

This OSX sample was contained within Apple DMG Installer “celastradepro_mac_installer_1.00.00.dmg.” When executed, CelasTradePro has identical functionality and appearance to the Windows version CelasTradePro.exe. It asks for the users’ exchange and loads a legitimate cryptocurrency trading application with no signs of malicious activity. As functionality and appearance are the same, it follows that CelasTradePro is a modification of the OSX QT Bitcoin Trader. In addition to similar appearance, many strings found in CelasTradePro have QT Bitcoin Trader references and parameters being set to “Celas Trade Pro” including but not limited to:

–Begin similarities–
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro is a free Open Source project<br>developed on pure C++ Qt and OpenSSL.
String_APPLICATION_TITLE=Qt Bitcoin Trader
julyighor@gmail.com (note: Ighor July is one of the developers of QT Bitcoin Trader)
–End similarities–

The strings also reference the name “John Broox” as the author of CelasTradePro.

While the CelasTradePro application is likely a modification of QT Bitcoin Trader, the legitimate QT Bitcoin Trader DMG for OSX does not contain the postinstall script nor the plist file which creates a LaunchDaemon. When ran, only QTBitcoinTrader will be installed, and no additional programs will be created, installed, or launched.

The CelasTradePro DMG contains the CelasTradePro OSX executable (the modified version of QT Bitcoin Trader) as well as the additional Updater OSX executable not included with the original QT Bitcoin Trader.

Screenshots

Figure 9 – Screenshot of the legitimate QTBitcoinTrader DMG contents.

5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0

Tags

backdoordownloaderloadertrojan

Details

Name
Updater

Size
50320 bytes

Type
Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>

MD5
aeee54a81032a6321a39566f96c822f5

SHA1
53aa0971eb5d53ed242764ebfc89ad591a5211b2

SHA256
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0

SHA512
9e9abc2c824df20249df9161ad830af2a3d01867089eed23d5985445e34120238881ac3cfd9529bf27588c36f2a17533a4bda8fce8c91949360c236b60852fb0

ssdeep
768:A4yOeE/pwi8Aea02PG2mG1oAK+g7mj78yfgum0+mifm:GOeE/pwFs02pvg7mj7bfgum0hi

Entropy
5.010104

Antivirus

Ahnlab
OSX/Agent.50320

Antiy
Trojan/OSX.Lazarus

Avira
VBS/Dldr.Formac.npwdq

BitDefender
Trojan.MAC.Lazarus

ClamAV
Osx.Malware.Agent-9667647-0

Comodo
Malware

ESET
a variant of OSX/TrojanDownloader.NukeSped.A trojan

Emsisoft
Trojan.MAC.Lazarus (B)

Ikarus
Trojan.MAC.Lazarus

Lavasoft
Trojan.MAC.Lazarus

Microsoft Security Essentials
Backdoor:MacOS/AppleJeus.A

NANOAV
Trojan.Mac.Mlw.fhnynm

Sophos
OSX/Lazarus-D

Symantec
OSX.Trojan.Gen

TrendMicro
OSX_LAZARUS.A

TrendMicro House Call
OSX_LAZARUS.A

Zillya!
Downloader.NukeSped.OSX.1

YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships

5e54bccbd4…
Contained_Within
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

Description

This OSX sample was contained within Apple DMG Installer “celastradepro_mac_installer_1.00.00.dmg.” Updater functions very similarly to the Windows Updater.exe, and collects victim host information to send back to the server. Upon launch, the malware checks for the “CheckUpdate” parameter, and just as the Windows sample, will exit if the parameter is not found. This is likely to avoid sandbox analysis. If the “CheckUpdate” parameter is found, the malware then creates a unique identifier for the system following the format “%09d-%06d.”

Updater then uses dedicated QT classes to get system information including host name, OS type and version, system architecture, and OS kernel type and version. The QT Framework is a cross-platform toolkit designed for creating multi-platform applications with native Graphical User Interfaces (GUI) for each platform.

After collecting this data, Updater follows the same process as the Windows “Updater.exe” to encrypt and send the data. All data is XOR encrypted with the hard-coded key “Moz&Wie;#t/6T!2y”, prepended with “GIF89a” (image header), and sent to www[.]celasllc.com/checkupdate.php. The malware uses the same multipart form data separator “jeus” but has a different hard-coded user-agent string of “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36.”

If Updater receives a response with the HTTP code 200, it will decode the base64 payload, and decrypt it using the same hard-coded RC4 key “W29ab@ad%Df324V$Yd” as the Windows malware. The decrypted data is then saved to the hard-coded “/var/zdiffsec” file location, file permissions are changed to executable for all users, and the file is started with the hard-coded command line argument “bf6a0c760cc642.”

Screenshots

Figure 10 – Screenshot of the “CheckUpdate” parameter verification in “Updater.”

Figure 11 – Screenshot of various hard-coded values in “Updater.”

Relationship Summary

6ee19085ad…
Downloaded_From
celasllc.com

6ee19085ad…
Contains
a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765

6ee19085ad…
Contains
bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb

celasllc.com
Downloaded_To
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

celasllc.com
Downloaded_To
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

a84ed8ce71…
Contained_Within
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

bdff852398…
Contained_Within
6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

d404c0a634…
Downloaded_From
celasllc.com

d404c0a634…
Contains
c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70

d404c0a634…
Contains
5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0

c0c2239138…
Contained_Within
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

5e54bccbd4…
Contained_Within
d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

Conclusion

After a cyber-security organization published a report detailing the above programs and their malicious extras, the Celas LLC site was no longer accessible. As this site was the command and control server (C2), the payload cannot be confirmed. The cyber security organization who published the AppleJeus report states the payload was an encrypted and obfuscated binary which eventually drops FALLCHILL onto the machine and installs it as a service.

The FALLCHILL sample found by the cyber security organization had two default C2 server addresses:
196.38.48.121 – South Africa Internet Solutions, AS3741
185.142.236.226 – Netherlands Amsterdam Blackhost Ltd ISP, AS174 Cogent Communications

The C2 185.142.236.226 resides in the same Autonomous System Number (ASN) and ISP as the celasllc.com domain. Furthermore, these IP addresses have been used in three earlier versions of FALLCHILL for C2 according to open source reporting:

–Begin MD5 and timestamp–
94dfcabd8ba5ca94828cd5a88d6ed488     2016-10-24 02:31:18
14b6d24873f19332701177208f85e776     2017-06-07 06:41:27
abec84286df80704b823e698199d89f7     2017-01-18 04:29:29
–End MD5 and timestamp–

File Properties for this sample of FALLCHILL after decryption:
MD5: d7089e6bc8bd137a7241a7ad297f975d
SHA-1: 15062b26d9dd1cf7b0cdf167f4b37cb632ddbd41
SHA-256: 08012e68f4f84bba8b74690c379cb0b1431cdcadc9ed076ff068de289e0f6774

FALLCHILL malware uses a RC4 encryption algorithm with a 16-byte key to protect its communications. According to reporting from the cyber-security organization that published the original AppleJeus report, the key extracted from the FALLCHILL variant used in the Celas Trade Pro application is “DA E1 61 FF 0C 27 95 87 17 57 A4 D6 EA E3 82 2B.” This RC4 key has also been used in a previous version of FALLCHILL used by DPRK actors, as further documented in the US-CERT Malware Analysis Report AR18-165A released on June 14, 2018. This report was a joint effort by the FBI and DHS, while working with other U.S. Government partners, to analyze and attribute computer intrusion activity from the DPRK.

Note: The version numbers for AppleJeus correspond to the order the campaigns were identified open source or through investigative means. These versions may or may not be in the correct order for development or deployment of the AppleJeus campaigns.

Recommendations

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization’s systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

Maintain up-to-date antivirus signatures and engines.
Keep operating system patches up-to-date.
Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
Restrict users’ ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
Enforce a strong password policy and implement regular password changes.
Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
Disable unnecessary services on agency workstations and servers.
Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
Monitor users’ web browsing habits; restrict access to sites with unfavorable content.
Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
Scan all software downloaded from the Internet prior to executing.
Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, “Guide to Malware Incident Prevention & Handling for Desktops and Laptops”.

Contact Information

1-888-282-0870
CISA Service Desk (UNCLASS)
CISA SIPR (SIPRNET)
CISA IC (JWICS)

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/

Document FAQ

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Service Desk.

Can I submit malware to CISA? Malware samples can be submitted via three methods:

Web: https://malware.us-cert.gov
E-Mail: submit@malware.us-cert.gov
FTP: ftp.malware.us-cert.gov (anonymous)

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA’s homepage at www.cisa.gov.

This product is provided subject to this Notification and this Privacy & Use policy.Original release date: February 17, 2021

Malware Analysis Report
10322463.r1.v1
2021-02-12

Notification

This report is provided “as is” for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.

This document is marked TLP:WHITE–Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.us-cert.gov/tlp.

Summary

Description

This Malware Analysis Report (MAR) is the result of analytic efforts among the Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Treasury (Treasury) to highlight the cyber threat to cryptocurrency posed by North Korea, formally known as the Democratic People’s Republic of Korea (DPRK), and provide mitigation recommendations. Working with U.S. government partners, FBI, CISA, and Treasury assess that Lazarus Group—which these agencies attribute to North Korean state-sponsored advanced persistent threat (APT) actors—is targeting individuals and companies, including cryptocurrency exchanges and financial service companies, through the dissemination of cryptocurrency trading applications that have been modified to include malware that facilitates theft of cryptocurrency.

This MAR highlights this cyber threat posed by North Korea and provides detailed indicators of compromise (IOCs) used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA. For more information on other versions of AppleJeus and recommended steps to mitigate this threat, see Joint Cybersecurity Advisory AA21-048A: AppleJeus: Analysis of North Korea’s Cryptocurrency Malware at https://www.us-cert.cisa.gov/ncas/alerts/AA21-048A.

There have been multiple versions of AppleJeus malware discovered since its initial discovery in August 2018. In most versions, the malware appears to be from a legitimate-looking cryptocurrency trading company and website, whereby an unsuspecting individual downloads a third-party application from a website that appears legitimate.

The U.S. Government has identified AppleJeus malware version—Celas Trade Pro—and associated IOCs used by the North Korean government in AppleJeus operations.

In August 2018, open source reporting revealed information about a Trojanized version of a legitimate cryptocurrency trading application on a victim’s computer (Note: identity of the victim was not disclosed). The malicious program, known as Celas Trade Pro, is a modified version of the benign QT Bitcoin Trader application. This incident led to the victim company being infected with the malware known to the U.S. Government as FALLCHILL, a North Korean remote administration tool (RAT). According to CISA, FALLCHILL “is a fully functional RAT with multiple commands that the actors can issue from a command and control (C2) server to a victim’s system via dual proxies. FALLCHILL typically infects a system as a file dropped by other HIDDENCOBRA malware. Because of this, additional HIDDENCOBRA malware may be present on systems compromised with FALLCHILL.”

Celas Trade Pro had been recommended to the victim company via a phishing email from a company known as Celas Limited. The email provided a link to the Celas Limited website (https://www[.]celasllc.com), where the user could download a Windows or MacOS version of the Celas Trade Pro software.

 

For a downloadable copy of IOCs, see: MAR-10322463-1.v1.stix.

Submitted Files (6)

5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0 (Updater)

6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69 (celastradepro_win_installer_1….)

a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765 (CelasTradePro.exe)

bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb (Updater.exe)

c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70 (CelasTradePro)

d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04 (celastradepro_mac_installer_1….)

Domains (1)

celasllc.com

Findings

6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69

Tags

droppertrojan

Details
Name celastradepro_win_installer_1.00.00.msi
Size 9827840 bytes
Type Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Last Printed: Fri Dec 11 11:47:44 2009, Create Time/Date: Fri Dec 11 11:47:44 2009, Last Saved Time/Date: Fri Dec 11 11:47:44 2009, Security: 0, Code page: 1252, Revision Number: {A3B40756-2C9C-4167-9296-5DD2DAF7973E}, Number of Words: 2, Subject: CelasTradePro, Author: CELAS LLC, Name of Creating Application: Advanced Installer 14.5.2 build 83143, Template: ;1033, Comments: This installer database contains the logic and data required to install CelasTradePro., Title: Installation Database, Keywords: Installer, MSI, Database, Number of Pages: 200
MD5 9e740241ca2acdc79f30ad2c3f50990a
SHA1 0c5e4cec03d2eea2b1dd5356fe05de64a0278cd6
SHA256 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69
SHA512 dd02c1e717c2556b64d261f04c5a8add7dcc2f3ad267507d883ba68c7e4cf827136edce517aab055dfa02d8569a5779eb1fc24fb0b7c6bb3447d45e2802726e5
ssdeep 196608:s80YaAWH7ICcfRLdq81w920W+ZP6g2DsjW1TIZfxgNu1DZNJQfIYizTrh50:sPUWHECcfBdR1w9NWqSg2DsK1TmfxgiD
Entropy 7.973409
Antivirus
Ahnlab MSI/Installer
Comodo Malware
Microsoft Security Essentials Trojan:Win32/Letdater
Quick Heal OLE.MSI.Agent.39994.GC
Sophos Troj/NukeSped-X
Symantec Trojan.Dropper
TrendMicro Trojan.BC27BA50
TrendMicro House Call Trojan.BC27BA50
YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships
6ee19085ad… Downloaded_From celasllc.com
6ee19085ad… Contains a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765
6ee19085ad… Contains bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb
Description

This Windows program from the Celas LLC site is a Windows MSI Installer. The installer looks legitimate and previously had a valid digital signature from Comodo (Sectigo). The signature was signed with a code signing certificate purchased by the same user as the Secure Sockets Layer (SSL) certificate for “celasllc.com.” The installer asks for administrative privileges to run and while installing “CelasTradePro.exe” (a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765) it also installs “Updater.exe” in the “C:Program Files (x86)CelasTradePro” folder. Immediately after installation, the installer launches “Updater.exe” (bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb) with the “CheckUpdate” parameter.

Screenshots

Figure 1 - Screenshot of the CelasTradePro installation.

Figure 1 – Screenshot of the CelasTradePro installation.

celasllc.com

Tags

command-and-control

URLs
  • celasllc.com/checkupdate.php
Whois

Whois for celasllc.com had the following information in August 2018:
IP Address: 185.142.236.213
Registrant Name: John Broox
Registrant Organization:
Registrant Street: 2141 S Archer Ave
Registrant City: Chicago
Registrant State/Province: Illinois
Registrant Postal Code: 60601
Registrant Country: US
Registrant Phone: +1.8133205751
Registrant Email: johnbroox200@gmail.com
Name server: 1a7ea920.bitcoin-dns.hosting
Name Server: a8332f3a.bitcoin-dns.hosting
Name Server: ad636824.bitcoin-dns.hosting
Name Server: c358ea2d.bitcoin-dns.hosting
Created: May 29, 2018
Expires: May 29, 2019
Updated: Sep 9, 2018

Relationships
celasllc.com Downloaded_To 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69
celasllc.com Downloaded_To d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04
Description

The Celas Limited website had a professional appearance, and at the time had a valid Secure Sockets Layer (SSL) certificate issued by Comodo (now Sectigo). The SSL certificate was “Domain Control Validated,” which is a weak security verification level for a webserver. Typically, this is a fully automated verification where the certificate requester only needs to demonstrate control over the domain name (i.e. with an email like admin[@]celasllc.com). This type of certificate necessitates no validation of the identity of the website’s owner, nor the existence of the actual business. At the time of analysis, the domain celasllc.com resolved to IP address 185.142.236.213, which belongs to the Netherlands Amsterdam Blackhost Ltd ISP, AS174, Cogent Communications.

Screenshots

Figure 2 - Screenshot of the Celas LLC website.

Figure 2 – Screenshot of the Celas LLC website.

a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765

Tags

trojan

Details
Name CelasTradePro.exe
Size 2517160 bytes
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 45eb8f06c5f732e8dde8e9318d8b2392
SHA1 d4583cba9034a3068f8106b5013d37d7bdd46f38
SHA256 a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765
SHA512 6536a7b0767828bb95f6f33a4e465fec48fc474b4f919bc878e02966f82f900fbaa6e2f9d7bc1dffa28bbe35f94ee6b9a570902843dfd35a8c9d1405ac130039
ssdeep 49152:TrxfUhMyK0lq3Z8SC8Q1ZZmpwi0qEdz+7WGSVOr:PxfU60lqiV1UL
Entropy 6.852284
Antivirus
Sophos Mal/BadCert-Gen
YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata
Compile Date 2018-06-17 20:17:48-04:00
Import Hash 33ef6aff05b44076249d6ed27e247e11
Company Name Celas LLC
File Description Celas Bitcoin Trader
Internal Name Celas Bitcoin Trader
Legal Copyright Copyright (C) 2018 CELAS LLC
Original Filename CelasTradePro.exe
Product Name CelasTradePro
Product Version 1.0.0.0
PE Sections
MD5 Name Raw Size Entropy
724cd82da1ca0a93b9d171923d149ce9 header 1024 2.738571
4909abcdca48f01dd7d44d7b6035deef .text 1152000 6.244241
88f7c98251537ffd1f94935b8c134b9a .rdata 1076224 6.842683
0e102f466e9e6893970e2fd96c8b3fce .data 9728 4.517533
87a4b3b57b1b37d19870a4f1c9577374 .rsrc 110592 3.737298
a6d8c9855dc4334bb35c95a1e0518a9d .reloc 162304 6.385957
Packers/Compilers/Cryptors
Microsoft Visual C++ ?.?
Relationships
a84ed8ce71… Contained_Within 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69
Description

This file is a 32-bit Windows executable contained within the Windows MSI Installer “celastradepro_win_installer_1.00.00.msi.” When executed, “CelasTradePro.exe” asks for the user’s exchange and then loads a legitimate cryptocurrency trading platform with no signs of malicious activity.

CelasTradePro is extremely similar in appearance to a version of an open source cryptocurrency trading platform available around the same timeframe known as QT Bitcoin Trader (screenshots 3 and 4). In addition to similar appearance, many strings found in CelasTradePro have QT Bitcoin Trader references and parameters being set to “Celas Trade Pro” including but not limited to:

–Begin similarities–
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro
QtBitcoinTrader
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro is a free Open Source project developed on pure C++ Qt and OpenSSL.
julyighor@gmail.com (note: Ighor July is one of the developers of QT Bitcoin Trader)
–End similarities–

The strings also reference the name “John Broox” as the author of CelasTradePro.

While the CelasTradePro application is likely a modification of QT Bitcoin Trader, the legitimate QT Bitcoin Trader for Windows is not available for download as an MSI, but only as a Windows portable executable. This is a singular file named “QtBitcoinTrader.exe” and does not install or run any additional programs. The CelasTradePro MSI contains “CelasTradePro.exe,” the modified version of QT Bitcoin Trader, as well as the additional “Updater.exe” (bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb) executable not included with the original QT Bitcoin Trader.

Screenshots

Figure 3 - Screenshot of the CelasTradePro application.

Figure 3 – Screenshot of the CelasTradePro application.

Figure 4 - Screenshot of the QT Bitcoin Trader application.

Figure 4 – Screenshot of the QT Bitcoin Trader application.

bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb

Tags

downloaderloaderspywaretrojan

Details
Name Updater.exe
Size 173224 bytes
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 b054a7382adf6b774b15f52d971f3799
SHA1 b4d43cd2d81d17dec523915c0fc61b4b29e62c58
SHA256 bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb
SHA512 7c307a2ed0e6e483a0f3e7161ff0433e6bd498ab0b14b5359a938554999b076c4143a766b96c05dc0b949948cac97d81534ceb1300d02276ec90e2c1162383a9
ssdeep 1536:XN9cIi98pUYi7tIP+arPg1ssvpoOJwtFT6BxdYIHs/5mBS0LiF:99clzLPPBoOJwWBxdYlxySr
Entropy 4.980364
Antivirus
Ahnlab Malware/Win32.Generic
Antiy Trojan[Downloader]/Win32.Agent
Avira TR/Dldr.Agent.jlhae
BitDefender Trojan.GenericKD.40404380
ClamAV Win.Spyware.Fallchill-6663754-2
Comodo Malware
ESET Win32/TrojanDownloader.NukeSped.E trojan
Emsisoft Trojan.GenericKD.40404380 (B)
Ikarus Trojan-Downloader.Agent
K7 Riskware ( 0040eff71 )
Lavasoft Trojan.GenericKD.40404380
McAfee Generic trojan.d
Microsoft Security Essentials Trojan:Win32/Letdater
NANOAV Trojan.Win32.Letscool.fflqoo
Sophos Troj/NukeSped-Y
Symantec Trojan Horse
Systweak trojan.agent
TrendMicro Trojan.BC27BA50
TrendMicro House Call Trojan.BC27BA50
VirusBlokAda TrojanDownloader.Agent
Zillya! Downloader.Agent.Win32.365188
YARA Rules

No matches found.

ssdeep Matches

No matches found.

PE Metadata
Compile Date 2018-06-15 06:56:27-04:00
Import Hash b25cd98650edb58a9a4d00af1d17453d
PE Sections
MD5 Name Raw Size Entropy
2c879beba343ce37c06647fb37be983e header 1024 2.572659
4da943f482631027a2152c6f336055af .text 38912 6.556738
0b7c67c806051953aa6addc2771a20eb .rdata 10240 4.875590
49f73fd786fe23fbc68635fbf76b63a3 .data 4096 2.272665
7a96caced6b43d719b90f6e332ad12f3 .rsrc 109568 3.715817
8aacf0cff202d7d74c04f938df61e45f .reloc 4096 4.127553
Packers/Compilers/Cryptors
Microsoft Visual C++ ?.?
Relationships
bdff852398… Contained_Within 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69
Description

This file is a 32-bit Windows executable contained within the Windows MSI Installer “celastradepro_win_installer_1.00.00.msi.” “Updater.exe” has the same program icon as CelasTradePro. Updater.exe was likely developed under the name “jeus” based on the build path “Z:jeusdownloaderdownloader_exe_vs2010Releasedloader.pdb” found in the code (partial origin of the name AppleJeus).

“Updater.exe” collects victim host information and sends it back to the server. At launch the malware first checks for the “CheckUpdate” parameter and if not found, exits the program. This is likely to evade detection in a sandbox environment. If the “CheckUpdate” parameter is found, the malware creates a unique identifier for the system following the format “%09d-%05d.” It then collects process lists excluding the “System” processes and queries the registry at “HKLMSOFTWAREMicrosoftWindow NTCurrentVersion” for the following values:

–Begin values–
ProductName (Windows OS Version)
CurrentBuildNumber (Windows 10 build version)
ReleaseID (Windows 10 version information)
UBR (Sub version of Windows 10 build)
BuildBranch (Windows 10 build branch information)
–End values–

After collecting this information, “Updater.exe” encrypts the data with the hard-coded XOR key “Moz&Wie;#t/6T!2y,” prepends the encrypted data with “GIF89a” (image header) and sends the data to “celasllc.com/checkupdate.php.”

The malware also uses a hard-coded User-Agent string “Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; Trident/6.0” and multipart form data separator “jeus.” If the malware receives a response with HTTP code 200, it will decode the base64 payload, then decrypt the result using the hard-coded RC4 decryption key “W29ab@ad%Df324V$Yd.” The raw data is then written to a file prepended with the “MAX_PATHjeusD” string.

Screenshots

Figure 5 - Screenshot of the "CheckUpdate" parameter verification in "Updater.exe."

Figure 5 – Screenshot of the “CheckUpdate” parameter verification in “Updater.exe.”

Figure 6 - Hard-coded XOR key and XOR encryption in "Updater.exe."

Figure 6 – Hard-coded XOR key and XOR encryption in “Updater.exe.”

d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

Tags

downloaderdropperloadertrojan

Details
Name celastradepro_mac_installer_1.00.00.dmg
Size 15020544 bytes
Type DOS/MBR boot sector; partition 1 : ID=0xee, start-CHS (0x3ff,254,63), end-CHS (0x3ff,254,63), startsector 1, 29336 sectors, extended partition table (last)
MD5 48ded52752de9f9b73c6bf9ae81cb429
SHA1 1e8a2f1f751e5a9931bca5710b4f304798d665dc
SHA256 d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04
SHA512 4c4e4445638ace360c82be741e634601bd1beaf980cdc02523484cc7f161b57015f325708ce72d9a2496f3b5bf2d05df5133aee0d1c375b76b23e6a660436d0f
ssdeep 393216:0naJ/9SL/uXRs1q5wxrCAveZZXFdklxkBSY6bzLZaM:bJ/9SLQRwqSrCAS5klxPY6bXZx
Entropy 7.710370
Antivirus
Antiy Trojan/OSX.Lazarus
Avira OSX/Lazarus.A
Comodo Malware
ESET OSX/TrojanDownloader.NukeSped.A trojan
Ikarus Trojan.OSX.Lazarus
McAfee OSX/Lazarus.a
Symantec OSX.Dropper
TrendMicro OSX_APPLEJEUS.A
TrendMicro House Call OSX_APPLEJEUS.A
Vir.IT eXplorer OSX.Lazarus.ASM
YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships
d404c0a634… Downloaded_From celasllc.com
d404c0a634… Contains c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70
d404c0a634… Contains 5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0
Description

This OSX program from the Celas LLC site is an Apple DMG Installer. The OSX program has very similar functionality to the Windows program and also previously had a valid digital signature from Comodo. Again the installer appears to be legitimate, and installs CelasTradePro as well as a program named “Updater” in the “/Applications/CelasTradePro.app/Contents/MacOS/” folder. The installer contains a postinstall script (see figure 6).

A postinstall script is a sequence of instructions which runs after the successful installation of an OSX application. This script moves the hidden “.com.celastradepro.plist” file from the installer package to the LaunchDaemons folder. This file is hidden because the leading “.” causes it to not be shown to the user if they view the folder in the Finder application. Once in the LaunchDaemons folder, this plist file will be ran on system load as root for every user. This will launch the Updater program with the CheckUpdate parameter.

As the LaunchDaemon will not run automatically after the plist file is moved, the postinstall script then launches the Updater program with the CheckUpdate parameter and runs it in the background (&). The package also has “Developed by John Broox. CELAS LLC” in the Info.plist properties file.

Screenshots

Figure 7 - Screenshot of the postinstall script included in OSX Celas installer.

Figure 7 – Screenshot of the postinstall script included in OSX Celas installer.

Figure 8 - Screenshot of the "com.celastradepro.plist" file.

Figure 8 – Screenshot of the “com.celastradepro.plist” file.

c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70

Tags

trojan

Details
Name CelasTradePro
Size 3544560 bytes
Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>
MD5 4eedb2df53597a15fd48b726d85517f0
SHA1 a60ece7673fa415abe1fb97ac60e19ee446858b1
SHA256 c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70
SHA512 853c85760576919bc59aee901663057a0bfd5a286345cc7464f61e7bdfdebfeb2148401597ae037bbf052c052112cb37c34924b2876383c920d17b908f0e3a85
ssdeep 49152:bvzxIgxauUDh0Dh6jQIRfzOQo14GNoiZPw6YBoOBzRK8IA1LGqBKta9w35wwlRoJ:3xuwhRIR2LPZPwX1vbL9BgwseMzio
Entropy 6.559908
Antivirus
Ahnlab OSX/Agent.3544560
Antiy Trojan/OSX.Lazarus
Avira OSX/Lazarus.dplva
BitDefender Trojan.MAC.Lazarus.B
ClamAV Osx.Malware.Agent-7408161-0
ESET a variant of Generik.IWGLIQC trojan
Emsisoft Trojan.MAC.Lazarus.B (B)
Ikarus OSX.Lazarus
Lavasoft Trojan.MAC.Lazarus.B
McAfee OSX/Lazarus.f
Sophos OSX/Lazarus-D
Symantec OSX.Malcol.2
Zillya! Trojan.MAC.OSX.89
YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships
c0c2239138… Contained_Within d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04
Description

This OSX sample was contained within Apple DMG Installer “celastradepro_mac_installer_1.00.00.dmg.” When executed, CelasTradePro has identical functionality and appearance to the Windows version CelasTradePro.exe. It asks for the users’ exchange and loads a legitimate cryptocurrency trading application with no signs of malicious activity. As functionality and appearance are the same, it follows that CelasTradePro is a modification of the OSX QT Bitcoin Trader. In addition to similar appearance, many strings found in CelasTradePro have QT Bitcoin Trader references and parameters being set to “Celas Trade Pro” including but not limited to:

–Begin similarities–
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro
String_ABOUT_QT_BITCOIN_TRADER_TEXT=Celas Trade Pro is a free Open Source project<br>developed on pure C++ Qt and OpenSSL.
String_APPLICATION_TITLE=Qt Bitcoin Trader
julyighor@gmail.com (note: Ighor July is one of the developers of QT Bitcoin Trader)
–End similarities–

The strings also reference the name “John Broox” as the author of CelasTradePro.

While the CelasTradePro application is likely a modification of QT Bitcoin Trader, the legitimate QT Bitcoin Trader DMG for OSX does not contain the postinstall script nor the plist file which creates a LaunchDaemon. When ran, only QTBitcoinTrader will be installed, and no additional programs will be created, installed, or launched.

The CelasTradePro DMG contains the CelasTradePro OSX executable (the modified version of QT Bitcoin Trader) as well as the additional Updater OSX executable not included with the original QT Bitcoin Trader.

Screenshots

Figure 9 - Screenshot of the legitimate QTBitcoinTrader DMG contents.

Figure 9 – Screenshot of the legitimate QTBitcoinTrader DMG contents.

5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0

Tags

backdoordownloaderloadertrojan

Details
Name Updater
Size 50320 bytes
Type Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>
MD5 aeee54a81032a6321a39566f96c822f5
SHA1 53aa0971eb5d53ed242764ebfc89ad591a5211b2
SHA256 5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0
SHA512 9e9abc2c824df20249df9161ad830af2a3d01867089eed23d5985445e34120238881ac3cfd9529bf27588c36f2a17533a4bda8fce8c91949360c236b60852fb0
ssdeep 768:A4yOeE/pwi8Aea02PG2mG1oAK+g7mj78yfgum0+mifm:GOeE/pwFs02pvg7mj7bfgum0hi
Entropy 5.010104
Antivirus
Ahnlab OSX/Agent.50320
Antiy Trojan/OSX.Lazarus
Avira VBS/Dldr.Formac.npwdq
BitDefender Trojan.MAC.Lazarus
ClamAV Osx.Malware.Agent-9667647-0
Comodo Malware
ESET a variant of OSX/TrojanDownloader.NukeSped.A trojan
Emsisoft Trojan.MAC.Lazarus (B)
Ikarus Trojan.MAC.Lazarus
Lavasoft Trojan.MAC.Lazarus
Microsoft Security Essentials Backdoor:MacOS/AppleJeus.A
NANOAV Trojan.Mac.Mlw.fhnynm
Sophos OSX/Lazarus-D
Symantec OSX.Trojan.Gen
TrendMicro OSX_LAZARUS.A
TrendMicro House Call OSX_LAZARUS.A
Zillya! Downloader.NukeSped.OSX.1
YARA Rules

No matches found.

ssdeep Matches

No matches found.

Relationships
5e54bccbd4… Contained_Within d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04
Description

This OSX sample was contained within Apple DMG Installer “celastradepro_mac_installer_1.00.00.dmg.” Updater functions very similarly to the Windows Updater.exe, and collects victim host information to send back to the server. Upon launch, the malware checks for the “CheckUpdate” parameter, and just as the Windows sample, will exit if the parameter is not found. This is likely to avoid sandbox analysis. If the “CheckUpdate” parameter is found, the malware then creates a unique identifier for the system following the format “%09d-%06d.”

Updater then uses dedicated QT classes to get system information including host name, OS type and version, system architecture, and OS kernel type and version. The QT Framework is a cross-platform toolkit designed for creating multi-platform applications with native Graphical User Interfaces (GUI) for each platform.

After collecting this data, Updater follows the same process as the Windows “Updater.exe” to encrypt and send the data. All data is XOR encrypted with the hard-coded key “Moz&Wie;#t/6T!2y”, prepended with “GIF89a” (image header), and sent to www[.]celasllc.com/checkupdate.php. The malware uses the same multipart form data separator “jeus” but has a different hard-coded user-agent string of “Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36.”

If Updater receives a response with the HTTP code 200, it will decode the base64 payload, and decrypt it using the same hard-coded RC4 key “W29ab@ad%Df324V$Yd” as the Windows malware. The decrypted data is then saved to the hard-coded “/var/zdiffsec” file location, file permissions are changed to executable for all users, and the file is started with the hard-coded command line argument “bf6a0c760cc642.”

Screenshots

Figure 10 - Screenshot of the "CheckUpdate" parameter verification in "Updater."

Figure 10 – Screenshot of the “CheckUpdate” parameter verification in “Updater.”

Figure 11 - Screenshot of various hard-coded values in "Updater."

Figure 11 – Screenshot of various hard-coded values in “Updater.”

Relationship Summary

6ee19085ad… Downloaded_From celasllc.com
6ee19085ad… Contains a84ed8ce714dff76b48b26414de9f045de561146d7eaa09019cbfbb2586c9765
6ee19085ad… Contains bdff852398f174e9eef1db1c2d3fefdda25fe0ea90a40a2e06e51b5c0ebd69eb
celasllc.com Downloaded_To 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69
celasllc.com Downloaded_To d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04
a84ed8ce71… Contained_Within 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69
bdff852398… Contained_Within 6ee19085ad5c17f989616d17ef68041910b3d0cbcf7e08cc7d7c1a1cb09e6b69
d404c0a634… Downloaded_From celasllc.com
d404c0a634… Contains c0c2239138b9bc659b5bddd8f49fa3f3074b65df8f3a2f639f7c632d2306af70
d404c0a634… Contains 5e54bccbd4d93447e79cda0558b0b308a186c2be571c739e5460a3cb6ef665c0
c0c2239138… Contained_Within d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04
5e54bccbd4… Contained_Within d404c0a634cef0d32029286fde8efccb6dfe1809066bbec7ac32d42c5ce3bc04

Conclusion

After a cyber-security organization published a report detailing the above programs and their malicious extras, the Celas LLC site was no longer accessible. As this site was the command and control server (C2), the payload cannot be confirmed. The cyber security organization who published the AppleJeus report states the payload was an encrypted and obfuscated binary which eventually drops FALLCHILL onto the machine and installs it as a service.

The FALLCHILL sample found by the cyber security organization had two default C2 server addresses:
196.38.48.121 – South Africa Internet Solutions, AS3741
185.142.236.226 – Netherlands Amsterdam Blackhost Ltd ISP, AS174 Cogent Communications

The C2 185.142.236.226 resides in the same Autonomous System Number (ASN) and ISP as the celasllc.com domain. Furthermore, these IP addresses have been used in three earlier versions of FALLCHILL for C2 according to open source reporting:

–Begin MD5 and timestamp–
94dfcabd8ba5ca94828cd5a88d6ed488     2016-10-24 02:31:18
14b6d24873f19332701177208f85e776     2017-06-07 06:41:27
abec84286df80704b823e698199d89f7     2017-01-18 04:29:29
–End MD5 and timestamp–

File Properties for this sample of FALLCHILL after decryption:
MD5: d7089e6bc8bd137a7241a7ad297f975d
SHA-1: 15062b26d9dd1cf7b0cdf167f4b37cb632ddbd41
SHA-256: 08012e68f4f84bba8b74690c379cb0b1431cdcadc9ed076ff068de289e0f6774

FALLCHILL malware uses a RC4 encryption algorithm with a 16-byte key to protect its communications. According to reporting from the cyber-security organization that published the original AppleJeus report, the key extracted from the FALLCHILL variant used in the Celas Trade Pro application is “DA E1 61 FF 0C 27 95 87 17 57 A4 D6 EA E3 82 2B.” This RC4 key has also been used in a previous version of FALLCHILL used by DPRK actors, as further documented in the US-CERT Malware Analysis Report AR18-165A released on June 14, 2018. This report was a joint effort by the FBI and DHS, while working with other U.S. Government partners, to analyze and attribute computer intrusion activity from the DPRK.

Note: The version numbers for AppleJeus correspond to the order the campaigns were identified open source or through investigative means. These versions may or may not be in the correct order for development or deployment of the AppleJeus campaigns.

Recommendations

CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization’s systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.

  • Maintain up-to-date antivirus signatures and engines.
  • Keep operating system patches up-to-date.
  • Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
  • Restrict users’ ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
  • Enforce a strong password policy and implement regular password changes.
  • Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
  • Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
  • Disable unnecessary services on agency workstations and servers.
  • Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its “true file type” (i.e., the extension matches the file header).
  • Monitor users’ web browsing habits; restrict access to sites with unfavorable content.
  • Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
  • Scan all software downloaded from the Internet prior to executing.
  • Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).

Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, “Guide to Malware Incident Prevention & Handling for Desktops and Laptops”.

Contact Information

CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/

Document FAQ

What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.

Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Service Desk.

Can I submit malware to CISA? Malware samples can be submitted via three methods:

CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA’s homepage at www.cisa.gov.

This product is provided subject to this Notification and this Privacy & Use policy.

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes:

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>