Coingotrade

Malware Profile Updated 24 days ago
Download STIX
Preview STIX
CoinGoTrade is a malicious software (malware) disguised as a legitimate cryptocurrency wallet application. It installs itself in the /Applications/CoinGoTrade.app/Contents/MacOS/ folder and presents a fully functional wallet program to its victims. The malware was first brought to public attention on June 3rd via a tweet from researcher @ccxsaber, which revealed a domain at coingotrade.com set up to lure victims into downloading the fake app. CoinGoTrade is likely a clone of an open-source cryptocurrency wallet application and carries payloads similar in functionality to those found in other malware like macOS X stage 2 from CoinGoTrade and Kupay Wallet, or the Windows stage 2 from Union Crypto. CoinGoTrade has strong links to AppleJeus, a long-running cyber threat campaign that uses trojanized trading applications to facilitate cryptocurrency theft. CoinGoTrade represents the fifth version of AppleJeus, with previous versions using an older variant of POOLRAT malware. This connection is further substantiated by the simultaneous circulation of CoinGoTrade, TinkaOTP, and Cryptoistic - another family of lightweight, backdoor binaries written primarily in Objective-C and C. Unlike CoinGoTrade, Cryptoistic is written in Swift but contains a significant amount of code bridged to Objective C, suggesting a developer more familiar with the older programming language. The practice of trojanizing cryptocurrency-related apps began with the AppleJeus operation in 2018. The group behind these operations appears to have met with reasonable success, as evidenced by the emergence of new attempts such as CoinGoTrade and Cryptoistic in 2020. If CoinGoTrade is already installed on a system and the user attempts to install Kupay Wallet, or if Kupay Wallet is already installed and the user tries to install CoinGoTrade or Dorusio, all CoinGoTrade files will be deleted. For more detailed information about CoinGoTrade and its connection to AppleJeus, refer to the MAR-10322463-5.v1 analysis report on the U.S. Cybersecurity & Infrastructure Security Agency (CISA) website.
What's your take? (Question 1 of 0)
0cd62bf8-ba77-4d06-9a37-81cbe0ac2f23 Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at.
IDVotesProfile Description
AppleJeus
2
AppleJeus is a notorious malware attributed to the North Korean APT Lazarus Group, designed primarily to steal cryptocurrency. This malicious software has been a key instrument in North Korea's financial theft operations, with threat groups pilfering $2.3 billion USD worth of crypto assets between M
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Associated Malware
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Threat Actors
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Associated Vulnerabilities
To see the evidence that has resulted in this association, create a free account
IDTypeVotesProfile Description
No associations to display
Source Document References
Information about the Coingotrade Malware was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
SourceCreatedAtTitle
MITRE
a year ago
AppleJeus: Analysis of North Korea’s Cryptocurrency Malware | CISA
MITRE
a year ago
Four Distinct Families of Lazarus Malware Target Apple's macOS Platform
CERT-EU
a year ago
3CX hack highlights risk of cascading software supply-chain compromises
CERT-EU
a year ago
N.K. Hackers Employ Matryoshka Doll-Style Cascading Supply Chain Attack on 3CX
CERT-EU
a year ago
N.K. Hackers Employ Matryoshka Doll-Style Cascading Supply Chain Attack on 3CX