JPCERT/CC Eyes

During JSAC2021 on 28 January 2021, there was a presentation about an attack group LuoYu, which targets Korean and Japanese organisations since 2014 [1][2]. Recently, JPCERT/CC came across malware WinDealer used by this group. This article introduces some findings of our analysis.

Malware WinDealer overview

WinDealer steals information of an infected PC and sends it to a C2 server as described in Figure 1.

Figure 1： Malware WinDealer behaviour overview

Once launched, the malware reads configuration from a file under C:\ProgramData and loads a DLL module on its memory. It steals information about the victim PC, network configuration and SNS applications etc. and saves them in a file with an “.a” extension under %TEMP%, which is then sent to a C2 server.
The following points will be described in the next sections.

• Read configuration
• Communicate with C2 servers
• Process and send stolen data
• Functions of modules loaded on memory

Read configuration

The malware stores its configuration in several folders under C:\ProgramData and reads it when executed. The contents are encoded based on XOR with its key value “b6a7%7486”. Please refer to Appendix A for the configuration file path and its contents. Figure 2 shows a function to decode configuration.

Figure 2：Function to decode a file storing configuration

Communicate with C2 servers

If the following configuration files exist in the designated folder, WinDealer loads the C2 server information from them and starts communicating.

• C:\ProgramData\ad5f82e8
• C:\ProgramData\1c76cbfe
• C:\ProgramData\9c3b6294

If no such file exists, WinDealer communicates to a random IP address in one of the following ranges (port 6999/UDP or 55556/TCP). It switches to an IP address in the other range at a certain interval.

• 113.62.0.0 - 113.63.255.255
• 111.120.0.0 - 111.123.255.255

Figure 3 shows the malware’s communication flow with its C2 server. First, it encrypts an AES key with RSA algorithm and sends to a C2 server. Information stolen from a victim PC is encrypted with this AES key and sent to a C2 server at a certain interval. After that, C2 server sends a command to the victim PC. The malware executes it and sends the result to the C2 server after encryption. Besides the data exchange, the malware also communicates with domains such as www[.]microsoftcom (non-existent at the moment) and icanhazip[.]com.

Figure 3: Communication flow with a C2 server

Figure 4 describes the communication contents when delivering an AES key. AES key and its CRC32 checksum value are encrypted with RSA1024bit public key. The public key is hardcoded in the sample, which is also used for other samples as well.

Figure 4： Example of contents sent with AES key

From the second round of communication and onwards, data is encrypted in AES128bit ECB mode based on the AES key which was dynamically generated during the initial communication. Please refer to Appendix B for the details of data format.

Process and send stolen data

WinDealer processes a series of stolen data as “.a” file in a folder under %TEMP%, encrypts it with AES and send it to a C2 server. The flow of event is illustrated in Figure 5. The modules steal and process the data, while WinDealer itself monitors the files under %TEMP%, encrypts the file and sends it to a C2 server.

Figure 5：Flow of events by WinDealer and modules

A part of the code for generating “.a” file by a module is as follows (Figure 6):

Figure 6： DLL module’s code to generate “.a” file

The stolen data is first stored in a file with an “.t” extension, which is then renamed to “.a”. The series of data is stored in different directories based on the data category, and they are taken out when “.a” file is created. Please refer to Appendix E for the details of each directory.
Before writing and reading the files, the data is encoded/decoded by XOR-based function with its key value “YYYY” as in Figure 7.

Figure 7：A function for XOR-based encoding when accessing “.a” file

Functions of modules loaded on memory

Once launched, WinDealer loads a DLL module in a PE format (encoded in the sample) on the memory and executes it (Figure 8).

Figure 8： Encoded module data

The malware obtains its file path, searches for a byte string “0xFF3456FF00” and extracts data from its offset 0xE. Using its offset 0x4 value and a XOR-based decode routine (Figure 9), a DLL module is loaded on the memory and then executed.

Figure 9： Decoding module

The loaded DLL module is named as “MozillaDll.dll”. There are 3 Export functions as follows:

• AutoGetSystemInfo: Steal data
• GetConfigInfo: Set configuration
• partInitOpt: Set commands

The loaded DLL module monitors the below items, saves related items in a separate file and obtains them to send out to a C2 server.

• Files stored in a USB memory
• Files under Documents, desktop and recycle bin
• Files under folders related to SNS applications

Please see Appendix D for the details of commands that C2 server sends and its contents.

In closing

Besides WinDealer, it has been confirmed that LuoYu uses other kinds of malware that operate in various platforms. We will report if we observe a new type of malware.
For your reference, SHA256 hash values of similar samples are listed in Appendix F.

- Yuma Masubuchi
(Translated by Yukako Uchida)

Reference

[1] “LuoYu” The eavesdropper sneaking in multiple platforms
https://jsac.jpcert.or.jp/archive/2021/pdf/JSAC2021_301_shui-leon_en.pdf

[2] Japan Security Analyst Conference 2021 -3rd Track-
https://blogs.jpcert.or.jp/en/2021/02/jsac2021report1.html

Appendix A WinDealer configuration

Appendix B WinDealer Contents of data exchanged

Appendix C WinDealer List of commands

*Parameter string: These strings are parsed from the received command and used as a command parameter

Appendix D List of commands of loaded modules

*Parameter string: These strings are parsed from the received command and used as a command parameter

Appendix E List of generated directories

Appendix F SHA256 hash values of similar samples

• EXE
  
  • 1e9fc7f32bd5522dd0222932eb9f1d8bd0a2e132c7b46cfcc622ad97831e6128
  • b9f526eea625eec1ddab25a0fc9bd847f37c9189750499c446471b7a52204d5a

• DLL
  
  • 0c365d9730a10f1a3680d24214682f79f88aa2a2a602d3d80ef4c1712210ab07
  • 2eef273af0c768b514db6159d7772054d27a6fa8bc3d862df74de75741dbfb9c