Our analysis provided insights into the intricate workings of the downloader, detailing its infection flow, traffic behavior, anti-analysis techniques, and evolutionary trajectory.

In this entry, we examine the behavior of the final Remote Access Trojan (RAT) that we recently managed to download from a C&C server, based on an Earth Hundun campaign from 2024.

In our first entry, we focused on the Waterbear downloader (the first stage) and examined its network behavior. This report uses a case study to describe how the threat actor uses the Waterbear RAT and plugin during the second stage and how Waterbear downloaders are spread to other machines, making it more difficult to detect and track.

Furthermore, we examine the major updates to Deuterbear, including the ability to accept plugins with shellcode formats and the ability to function even without handshakes during RAT operation.

Finally, we will share our findings about the interaction between Earth Hundun and its victims through the Waterbear and Deuterbear malware, showcasing the sophisticated tactics employed by this threat actor.

Waterbear case study

The following flow chart from a previous campaign illustrates how Waterbear operates in the victim’s environment and then spreads more Waterbear downloaders across the internal network.

First stage

Waterbear usually employs a group of three files for downloading purposes during the first stage of an attack (as mentioned in the previous report). These include the patched legitimate executable, the loader, and the encrypted downloader.

Second stage

1. After connecting to the C&C server, we downloaded the Waterbear RAT (A) in memory, which contains several command codes inside (see Table 1 for the list of RAT commands). In this case, the Waterbear RAT (A) was only used to download the Waterbear plugin via RAT command 1010 and activate the first export function, “Start”, in the plugin to inject the chosen process.
2. The Waterbear plugin contains Waterbear downloader versions 0.27 and 0.28, both unencrypted, varying based on the process’s bit version. If the process is 32-bit, version 0.27 of the Waterbear downloader will run. On the other hand, version 0.28 will execute to facilitate further downloads on the 64-bit process.

   Waterbear downloader versions 0.27 and 0.28 are the latest that we know of. Their behaviors are the same as the versions before 2020.

3. In this case, the Waterbear plugin injects into a 64-bit process, which results in version 0.28 of the Waterbear downloader trying to connect to the new C&C IP address — which is assigned by Waterbear RAT (A)  —  and download Waterbear RAT (B), which is almost the same as the previous one, just with a different RSA key inside.
4. Waterbear RAT (B) will be used to collect the information from the infected machine, including the list of drives and files, and then further spread the Waterbear downloader to other machines. Interestingly, Earth Hundun will replace the C&C string with an internal IP address after downloading the new stage of the RAT or downloader. This is to erase activity traces or connect to other C&C servers in the victim’s environment, showing that the threat actor can arbitrarily choose its connection targets.

Waterbear RAT command

Since discussing Waterbear’s functions in our previous blog entry, there have been more that have been implemented, with the latest version shown in the following table:

^{Table 1. List of Waterbear RAT commands}

Before receiving the backdoor command, the RAT sends the victim’s information to the C&C server via command code 8002:

^{Table 2. The structure of victim information that Waterbear sends to the C&C server}

This section will explain Earth Hundun’s use of Deuterbear and provide a comprehensive analysis of the Deuterbear RAT.

Deuterbear installation

The installation pathway of Deuterbear is depicted in Figure 3. Note that it is similar to Waterbear, which implements two stages to install the backdoor.

In the first stage, the loader employs a basic XOR calculation to decrypt the downloader, facilitating the retrieval of the first stage RAT from the C&C server. Subsequently, the threat actor applies the first stage RAT to survey the victim’s system and identify an appropriate folder for persistence. This is where the second-stage Deuterbear components will be installed, including the loader with CryptUnprotectData decryption, the encrypted downloader, and associated registries (the decryption flow was discussed in the previous blog entry).

In most of the infected systems, only the second stage Deuterbear is available. Our monitoring indicates that all components of the first stage Deuterbear are totally removed after the “persistence installation” is completed. It seems that Earth Hundun prefers to keep the loaders using CryptUnprotectData decryption, even in cases where the successful installation of Deuterbear is achieved during the first stage. This strategy effectively protects their tracks and prevents the malware from easily being analyzed by threat researchers, particularly in simulated environments rather than real victim systems.

Deuterbear RAT

The Deuterbear RAT directly inherits several components from the downloader, including:

• All anti-analysis techniques (please refer to our previous report for more details).
• HTTPS tunnel.
• Routine to receive and send traffic.
• RC4 key to decrypt and encrypt traffic.
• Routine to decrypt and encrypt the desired function.
• Key to decrypt and encrypt the desired function.

Due to having the same HTTPS channel and RC4 traffic key, Deuterbear RAT doesn’t require a handshake with the C&C server to update communication protocols. This enables the threat actor to seamlessly control the client, regardless of whether the process is in the downloader or RAT status. Prior to executing backdoor commands, the Deuterbear RAT transmits victim information to the C&C server via RAT command 975 with the structure (Table 3) highly reminiscent of the Waterbear RAT (Table 2).

^{Table 3. The structure of victim information that Deuterbear sends to the C&C server}

Deuterbear RAT command

Comparing Deuterbear with Waterbear reveals several functionalities directly replicated from the Waterbear RAT, such as process management, file management, and remote shell capabilities. 

Although Deuterbear streamlines its capabilities, retaining only 20 RAT commands (Table 4) compared to over 60 for Waterbear (Table 1), the Deuterbear RAT accepts more plugins to enhance flexibility and accommodate additional functionalities, including two shellcodes and a portable executable (PE) DLL via RAT command 979. After installing the plugins, the threat actor sends the next traffic to determine which plugin is launched. There are three kinds of protocols:

• Execute the first shellcode and the first export function of PE(DLL)
• Execute the second shellcode and the first export function of PE(DLL)
• Only execute the first export function of PE(DLL)

^{Table 4. List of Deuterbear RAT commands}

Examples of similarities in backdoor commands between Waterbear and Deuterbear are shown in the images from Figure 4 to Figure 6.

Comparison

Comparing the Waterbear and Deuterbear downloaders, Table 5 shows the differences in the RAT part:

^{Table 5. Differences between the Waterbear RAT and Deuterbear RAT}

Conclusion and recommendations

Waterbear has gone through continuous evolution, eventually giving rise to the emergence of a new malware, Deuterbear. Interestingly, both Waterbear and Deuterbear continue to evolve independently, rather than one simply replacing the other.

Based on the downloader analysis presented in April 2024. We made a comprehensive examination of the RAT, which is a component seldom downloaded from the C&C server due to temporary port openings. Through a systematic comparison of Deuterbear and Waterbear in the loader, downloader, RAT and behavioral aspects, we gained insights into the evolution of the techniques employed by Earth Hundun. While the Waterbear and Deuterbear family represent just one facet of the group’s arsenal, we believe that continuous refinement of tools will be implemented in other malware for anti-analysis, and detection evasion, particularly in traffic and file handling.

Organizations can defend themselves from Earth Hundun attacks by performing a memory scan for downloads and the Waterbear and Deuterbear RATs. Furthermore, detecting the registry used to decrypt the Deuterbear downloader can help scan for its presence within the system.

MITRE ATT&CK

Indicators of Compromise

The indicators of compromise for this entry can be found on this link.