For the launcher, Waterbear uses a legitimate executable to load its custom DLL file. In some cases, its operators patched the legitimate executable to modify the import table. This includes adding the DLL with the same file name at ordinal 0, enabling a smooth launch of the loader via DLL sideloading. This strategy allows Earth Hundun to run its custom DLL loader and avoid detection.

Loader

Based on the diagram shown in Figure 1, there are two decryption routines used by Waterbear to decrypt the encrypted downloader.

Decryption Routine 1

We observed that recent Waterbear loader routines commonly use the same custom salted RC4 decryption, accompanied by a similar obfuscation pattern, to decrypt the downloader. This approach is consistent across downloader versions 0.13, 0.16, and 0.24. In contrast, earlier versions of the Waterbear loader were barely obfuscated, if at all.

Decryption Routine 2

In some cases, Waterbear loaders routinely place the encrypted downloader in the registry in advance, with the downloader being decryptable only on the infected machine since it uses the CryptUnprotectData API. This method is limited by the requirement that it must operate on the infected machine. However, it can prevent the victim from realizing that they are being attacked, while also hindering incident responders during investigation.

Downloader

Earth Hundun has been gradually refining its technique to bypass antivirus software adding a large amount of padding with 0x00 around the beginning and end to avoid detection. After decryption, the loader executes the shellcode directly and checks the debugger mode, initiating the Waterbear downloader.

Anti-Memory scanning

1. Decrypts the function before using it and encrypts it again after use
2. After recovering the function address, they quickly move it to another place in memory and mess-up the original address.

For more detailed information, please refer to our previous report, specifically the section titled “Anti-memory scanning of shellcode payload.”

Configuration

The configuration outlined in the previously mentioned report contains the information required for proper execution and communication with C&C server.

^{Table 1. The configuration structure of Waterbear downloader}

Network behavior

For the network request, the downloader will set up the custom connection to deliver the next stage RAT as follows:

^{Table 3. Packet format for sending KEY_RANDOM.}

The header contains the command code 0x40 0x1F, and the size of the data in the last four bytes by little-endian, but this variant’s obfuscation method is more complex than the previous version. The C&C server will perform the reversed calculation to decrypt the header and data while the KEY_RANDOM will be applied to the key of the salted RC4 in the next packets. The KEY_2 is the unique ID to check the target.

C&C Verification

C&C server sends the packet to victim for verification with the format:

^{Table 4. Packet format for C&C verification.}

Get RAT Size

C&C server sends the packet for RAT size with the format:

^{Table 6. Packet format for getting the RAT}

This step repeatedly receives the packet from the C&C server until the whole RAT is delivered.

RAT command

Since TeamT5’s article in 2020 discussing Waterbear’s functions, there have been more of them that have been implemented, with the latest version shown in this table:

^{Table 7. List of RAT command and corresponding functionalities.}

For more details about Waterbear’s past activities, please refer to our 2019 report.

Deuterbear details

The Deuterbear downloader, the latest Waterbear downloader, has been active since 2022 based on our telemetry. Because of significant updates in the decryption flow and configuration structure, we classify this variant as a distinct malware entity separate from the original Waterbear downloader category.

Attack chain and TTPs of Deuterbear

Loader

The decryption flow is limited on the victim’s side due to the API (CryptUnprotectData) and the need for more parameters, which are defined by the threat actor:

1. Query password from registry (HKLM|HKCU|HKCR)SOFTWAREClassesCLSID{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx} with key ‘AppID’
2. Query path of encrypted downloader from registry (HKLM|HKCU|HKCR) SOFTWAREClassesCLSID{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxx}InprocServer32
3. Downloader decryption
   _{a. XOR with password from offset 16~999
   b. CryptUnprotectData without password
   c. XOR with password from offset 0~999
   d. CryptUnprotectData with password}

Note that the CLSID value is unique and defined during malware installation.

Downloader

The Deuterbear downloader enables HTTPS tunnel to protect the network traffic and implements the following obfuscation methods for anti-analysis:

1. Breaking the function using jmp
2. Checking debugger mode by process time
3. Checking sandbox environment by API, Sleep, which is normal operation
4. Checking execution in specific time, like 9~10 o’clock
5. Implementing anti-memory scanning

Anti-Memory scanning

Anti-memory scanning, which is inherited from the Waterbear downloader, encrypts all function blocks (except for the function involving decode routine) with a fixed key defined in configuration. However, the Deuterbear downloader executes the desired function in new virtual memory, and not in the local address that stores all the encrypted function blocks.

Configuration

^{Table 8. The configuration structure of the Deuterbear downloader}

Network behavior

^{Table 9. Basic information on traffic to download Deuterbear RAT}

Deuterbear uses only 5 bytes in the header to describe the data information, with the general format being the following:

^{Table 16. Packet format for downloading the RAT}

This step repeatedly receives the packet from the C&C server until the whole RAT is delivered. The received Deuterbear RAT is in a shellcode format, unlike the original Waterbear downloader that loads the PE file for the next-stage RAT.

Comparison

Table 17 shows the difference between the Deuterbear downloader and Waterbear downloader:

^{Table 17. Differences between the Deuterbear downloader and Waterbear downloader}

Conclusion

Since 2009, Earth Hundun has continuously evolved and refined the Waterbear backdoor, as well as its many variants and branches. Despite available solutions, the enhancements in infection methods and anti-analysis mechanisms have led to the most advanced variant so far — Deuterbear. The Deuterbear downloader employs HTTPS encryption for network traffic protection and implements various updates in malware execution, such as altering the function decryption, checking for debuggers or sandboxes, and modifying traffic protocols.

According to our telemetry, Earth Hundun has continued to infiltrate the Asia-Pacific region, and the ongoing evolution of Waterbear and Deuterbear presents formidable challenges to organizational defense efforts.  As such, Trend Micro remains committed to further enhancing our monitoring and detection methods accordingly.

MITRE ATT&CK

Indicators of Compromise

The indicators of compromise for this entry can be found here.

We’d like to thank Trend’s Dove Chiu and Shih-hao Weng for additional intelligence.