Coingotrade

CoinGoTrade is a malicious software (malware) disguised as a legitimate cryptocurrency wallet application. It installs itself in the /Applications/CoinGoTrade.app/Contents/MacOS/ folder and presents a fully functional wallet program to its victims. The malware was first brought to public attention on June 3rd via a tweet from researcher @ccxsaber, which revealed a domain at coingotrade.com set up to lure victims into downloading the fake app. CoinGoTrade is likely a clone of an open-source cryptocurrency wallet application and carries payloads similar in functionality to those found in other malware like macOS X stage 2 from CoinGoTrade and Kupay Wallet, or the Windows stage 2 from Union Crypto. CoinGoTrade has strong links to AppleJeus, a long-running cyber threat campaign that uses trojanized trading applications to facilitate cryptocurrency theft. CoinGoTrade represents the fifth version of AppleJeus, with previous versions using an older variant of POOLRAT malware. This connection is further substantiated by the simultaneous circulation of CoinGoTrade, TinkaOTP, and Cryptoistic - another family of lightweight, backdoor binaries written primarily in Objective-C and C. Unlike CoinGoTrade, Cryptoistic is written in Swift but contains a significant amount of code bridged to Objective C, suggesting a developer more familiar with the older programming language. The practice of trojanizing cryptocurrency-related apps began with the AppleJeus operation in 2018. The group behind these operations appears to have met with reasonable success, as evidenced by the emergence of new attempts such as CoinGoTrade and Cryptoistic in 2020. If CoinGoTrade is already installed on a system and the user attempts to install Kupay Wallet, or if Kupay Wallet is already installed and the user tries to install CoinGoTrade or Dorusio, all CoinGoTrade files will be deleted. For more detailed information about CoinGoTrade and its connection to AppleJeus, refer to the MAR-10322463-5.v1 analysis report on the U.S. Cybersecurity & Infrastructure Security Agency (CISA) website.