Kupay Wallet

Kupay Wallet is a form of malware, specifically part of the "AppleJeus" family of malicious cryptocurrency applications. This family, which includes Kupay Wallet among other programs like Celas Trade Pro, WorldBit-Bot, Union Crypto Trader, CoinGoTrade, Dorusio, CryptoNeuro Trader, and Ants2Whale, has been developed and deployed by North Korean hackers from March 2018 through at least September 2020. These applications provide backdoor access to victims' computers, posing a significant cyber threat especially to the cryptocurrency sector. The Cybersecurity and Infrastructure Security Agency (CISA) reported on an attack wave involving Kupay Wallet in 2021 as part of the broader AppleJeus campaign. The payloads of Kupay Wallet are likely similar in functionality to those from CoinGoTrade and Union Crypto for macOS X stage 2, or Windows stage 2. CISA identified the earliest sample of PondRAT as part of a cryptocurrency-themed Kupay Wallet macOS malware package during this campaign. Interestingly, there appear to be installation conflicts when users attempt to install multiple applications from the AppleJeus family on the same system. For instance, if Kupay Wallet is already installed and the user tries to install CoinGoTrade or Dorusio, they will encounter issues. Similarly, if Dorusio or CoinGoTrade are already installed, attempts to install Kupay Wallet will result in conflicts. Despite some cosmetic differences, such as the Dorusio logo and two new services, the wallet appears to be largely identical to the Kupay Wallet.