Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Вход Регистрация
MITRE ATT&CK - Инструмент AppleJeus
Каталоги
MITRE ATT&CK
БДУ ФСТЭК
Новая БДУ ФСТЭК
Риски
Каталоги
MITRE ATT&CK
Инструмент
AppleJeus
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

AppleJeus

AppleJeus is a family of downloaders initially discovered in 2018 embedded within trojanized cryptocurrency applications. AppleJeus has been used by Lazarus Group, targeting companies in the energy, finance, government, industry, technology, and telecommunications sectors, and several countries including the United States, United Kingdom, South Korea, Australia, Brazil, New Zealand, and Russia. AppleJeus has been used to distribute the FALLCHILL RAT.(Citation: CISA AppleJeus Feb 2021)
ID: S0584
Type: MALWARE
Platforms: Windows
Version: 1.1
Created: 01 Mar 2021
Last Modified: 28 Sep 2022

Techniques Used
Domain ID Name Use
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control

AppleJeus has presented the user with a UAC prompt to elevate privileges while installing.(Citation: CISA AppleJeus Feb 2021)
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

AppleJeus has sent data to its C2 server via POST requests.(Citation: CISA AppleJeus Feb 2021)(Citation: ObjectiveSee AppleJeus 2019)
Enterprise T1059 .004 Command and Scripting Interpreter: Unix Shell

AppleJeus has used shell scripts to execute commands after installation and set persistence mechanisms.(Citation: CISA AppleJeus Feb 2021)(Citation: ObjectiveSee AppleJeus 2019)
Enterprise T1543 .003 Create or Modify System Process: Windows Service

AppleJeus can install itself as a service.(Citation: CISA AppleJeus Feb 2021)

.004 Create or Modify System Process: Launch Daemon

AppleJeus has placed a plist file within the LaunchDaemons folder and launched it manually.(Citation: CISA AppleJeus Feb 2021)(Citation: ObjectiveSee AppleJeus 2019)

Enterprise T1546 .016 Event Triggered Execution: Installer Packages

During AppleJeus's installation process, it uses `postinstall` scripts to extract a hidden plist from the application's `/Resources` folder and execute the `plist` file as a Launch Daemon with elevated permissions.(Citation: ObjectiveSee AppleJeus 2019)
Enterprise T1564 .001 Hide Artifacts: Hidden Files and Directories

AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.(Citation: CISA AppleJeus Feb 2021)
Enterprise T1070 .004 Indicator Removal: File Deletion

AppleJeus has deleted the MSI file after installation.(Citation: CISA AppleJeus Feb 2021)
Enterprise T1566 .002 Phishing: Spearphishing Link

AppleJeus has been distributed via spearphishing link.(Citation: CISA AppleJeus Feb 2021)
Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

AppleJeus has created a scheduled SYSTEM task that runs when a user logs in.(Citation: CISA AppleJeus Feb 2021)
Enterprise T1553 .002 Subvert Trust Controls: Code Signing

AppleJeus has used a valid digital signature from Sectigo to appear legitimate.(Citation: CISA AppleJeus Feb 2021)

Enterprise T1218 .007 System Binary Proxy Execution: Msiexec

AppleJeus has been installed via MSI installer.(Citation: CISA AppleJeus Feb 2021)
Enterprise T1569 .001 System Services: Launchctl

AppleJeus has loaded a plist file using the launchctl command.(Citation: CISA AppleJeus Feb 2021)
Enterprise T1204 .001 User Execution: Malicious Link

AppleJeus's spearphishing links required user interaction to navigate to the malicious website.(Citation: CISA AppleJeus Feb 2021)
.002 User Execution: Malicious File

AppleJeus has required user execution of a malicious MSI installer.(Citation: CISA AppleJeus Feb 2021)

Enterprise T1497 .003 Virtualization/Sandbox Evasion: Time Based Evasion

AppleJeus has waited a specified time before downloading a second stage payload.(Citation: CISA AppleJeus Feb 2021)

Groups That Use This Software
ID Name References
G0032 Lazarus Group

(Citation: CISA AppleJeus Feb 2021)

References

  1. Cybersecurity and Infrastructure Security Agency. (2021, February 21). AppleJeus: Analysis of North Korea’s Cryptocurrency Malware. Retrieved March 1, 2021.
  2. Patrick Wardle. (2019, October 12). Pass the AppleJeus. Retrieved September 28, 2022.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.