“LuoYu”

The eavesdropper sneaking in multiple platforms

Leon & Shui

Speakers’ Bio

Shui is a cyber threat Analyst
working for TeamT5. Holding amaster’s degree from Johns Hopkins
SAIS, she has a keen eye forinternational affairs. She mainly
works on Cyber Espionage campaign

tracking and involves in theunderground market research.

2Leon is a cyber threat analyst in theCyber Threat Intelligence team at
TeamT5. His major areas of research
include APT campaign tracking,malware analysis. He has participatedin information security diagnosis
services for government and financial
institutions and research on
vulnerabilities in IoT devices in thepast.

AGENDA
01

The Luoyu Threat Group Overview

02

Activity Timeline

03

ReverseWindow Analysis

04

Case Study05

Key Takeaway

The Luoyu Group Overview

The name: 蠃魚 (Luoyu)蠃魚(LuoYu) a Chinese mythological creatureu 蠃魚，魚身而鳥翼，音如鴛鴦，見則其邑大水。
u Translation: Fish with a pair of wings; When it
appears, floods always follow.
uOrigin
China

MalwareReverseWindow

WinDealer

SpyDealer

Target Industry

ProfileTechnology

Media

Education

Target Areas
China

Hong KongJapan

Korea

TaiwanGoalAttack

Message Apps

Collecting informationfrom dissidents?

Activity Timeline

2014-2017 China focused20142015

2017

2016

Spying apps circulatingin the wild

Android malware spying on Apps

And more…

2017- now: Expand to East Asia
Jun. 2017

May. 2019

University in Hong Kong

Apr. 2017

IT company in Taiwan,Japan, and South Korea

IT company in China

2019

Watering Hole Attack
against Chinese Website

Malware profile: ReverseWindowMalware profile: ReverseWindowu

ReverseWindow(aka sysetmd, OSX.Demsty) is a multi-platform malware,
it supports Windows, Linux, Mac, Android.

uCreate mutex string prefix “LOOTWODNIW” is the reverse of “WINDOWTOOL”.

u

Use DES algorithm for configuration decryption and data encryption.

uUses TLV(type-length-value) protocol to send and receive data.

Evolution of ReverseWindow

Evolution of ReverseWindow
IT company in Taiwan, Japan,and South Korea

IT company in China

University researcher in Hong Kong

Android app
1.1.6
1.1.7

1.2.1

1.2.27

Apr. 2017 May. 2017 Jul. 2017

0.997

1.3.3d

2.2.19102123 2.2.1905131

Jan. 2019 May. 2019 Aug. 2019Nov. 2019

Discovery time in the wild(20+ samples)

2.2.1911271 2.2.2006131

Mar. 2020

Dec. 2020

Icons made by https://www.flaticon.com/authors/freepik
Icons made by https://www.flaticon.com/authors/pixel-perfect

In-Depth Analysis of ReverseWindow

Hide the malicious tracesu

At first run, ReverseWindow will make the user think that the file was corrupted.

uPersistence method:u

Copy self to ” ~/.local/bin/sysetmd”, write .bashrc and create cronjob.

OSXLinuxDecrypt malware C&C configuration

Config head signature (16 bytes)

EncryptedMalware
ConfigReverseWindow

malwareConfiguration

Encrypted Config block
DES_ECB_decrypt
config size (2 Bytes)

AA BB CC DD

Decrypt malware C&C configurationu

Test Sample C2:192.168.8.107:10443
type lengthmalware
Configuration

valueCollecting host informationuHostnameuOperating System VersionuUser nameu

MAC address and IP address (IPv6,IPv4)u

CPU infou

the amount of physical RAMu

External IP addressuHard drive volume name (Windows only)uRemovable device file (Windows only)Collecting host information
The victim information is arranged by TLV(type-length-value) format.
u ReverseWindow encrypts victim data using DES algorithm with hard-coded
key table.
uhead signature
SizeIndex
Index
Size4 bytes
1 byte

Data
Data.
.
.

DES_encrypt

Encrypted victim data

Icons made by https://www.flaticon.com/authors/freepikCollecting host information
Send Beacon
response
Send victim infomation
ReverseWindow

Send command

C2 Server

Monitor directory
Upload any file(*.a) then delete“%temp%\~victim_id\~tmpdata”
Icons made by https://www.flaticon.com/authors/those-icons

Windows platform only

Custom ReverseWindow Android APKu

In 2019, LuoYu actor developed an Android variant of ReverseWindow.

u

We found that the attacker disguised the apk as a popular messaging app.

u

The actor also added another custom-developed spying library to the apk.

u

Unfortunately, currently, we are unsure how the actor spread the malware.

Custom ReverseWindow Android APK

Install

Load library
Malicious APK

Connect to C2
ReverseWindow
ELF

decrypt config

Config file

Icons made by https://www.flaticon.com/authors/freepik

C2 Server
Collect sensitive data

Custom spying libraryVersion changes
Windows 1.2.27

The command Protocol 0x0100(install Persistence) was only supportedin Windows(1.2.27)

OSX 1.2.1

Support proxy setting

Windows 2.2.*

String obfuscation
Stack string & GetProcessAddress to get WinAPI

Windows 2.2.1905131

ReverseWindow interest in two popular messaging appand three popular browsers in China (360SE, 360chrome, SougouExplorer)

Windows 2.2.2006131

Support networking status

Command Details
Command code

CommonDescription

0x0200File Operations

0x0300

Shell Command0x0400

update RAT

0x0500

Uninstall RAT

0x0800Update malware Config

Command Details
Command code

CommonDescription

0x0900(Linux)install plug-in | (Windows)execute a file

0x0A00(Windows only) Screenshot

0x0B00Proxy0x1200(Windows only) Enumerate process, Netstat

Command Details
Command code
0x0900
0x0A00Description(Windows) execute a file

expatriate

Screenshot
dissident

CommonMonitor certain VPN tools Profiles

Command Details
Command code

AndroidDescription

0x0700

setTransType

0x0A00setCaptureScreen

0x0F00setRecordConfig

0x1000

setSMSConfig

0x1100setCallLogConfig

Targeted attack
Monitordissident ChineseControl

Collect data

ReverseWindow

NotifyC2 Server

Victim hostCheck installed app
Over the wall

China Great Firewall

1. Three popular browsers in China
2. Two messaging apps
3. Proxy SettingTargeted attack
ExpatriateControlimplant

ReverseWindow

upload VPN profiles

C2 Server

Victim hostCollect VPN profiles
connect

VPN tools

lateral movement

Enterprise Firewall

Intranet Server

Case Study

Watering hole attackuCompromised a Chinese news site
based in the US

Watering hole attacku

Malicious Files disguised as
legitimate programs

qq.exeWinDealer
youku.exe

More APKs foundC2 Server

IT company in East Asia
2017

2019

ReverseWindow(MacOS ver.)

ReverseWindowMessaging Apps Focused
2015-2017
Android malware spying on Apps2018

APK disguised as Wechat

2017&2019

Attack IT companies in East Asia

Collecting information frommessaging apps
uThe 2019 attack overlapped with Hong
Kong anti-extradition bill protest

To collect protesters’ information?

Before 2017u Monitoring messaging apps ofindividual users

After 2017

Monitoring messaging apps of individualusers
u Attack the IT company which develops appsfor direct user information?
uThreat for both users and company
Installed

Collect personal messages
ReverseWindow apk&SpyDealer

Personal Mobile

Installed
Collect user information

PCs in companies

ReverseWindow(MacOS, Windows, Linux)

Key Takeaway

Key TakeawayuLuoyu is a well-developed Chinese APT.

uIts cyber attacks have started since 2014uu

Keep developing malware crossing multi-platformuMonitoring expatriate and dissident

It has expanded its target scope.
uChina’s neighbor countries

uAgainst IT companies

THANK YOU!