Waterbear

WaterBear is a sophisticated form of malware, known for its ability to exploit and damage computer systems. It infiltrates systems through suspicious downloads, emails, or websites, often unbeknownst to the user. Once inside, it can steal personal information, disrupt operations, or hold data hostage for ransom. WaterBear uses a 256 RC4 state box with byte shifting and addition within the key scheduling algorithm. Variants of WaterBear implement API hooking, a technique not seen in similar malware like BendyBear. Both WaterBear and BendyBear use a modified RC4 encryption, but their implementations differ slightly. The attack chain and Tactics, Techniques, and Procedures (TTPs) of WaterBear show some distinct characteristics. For instance, anti-memory scanning is a feature inherited from the WaterBear downloader, which encrypts all function blocks (except for the decode routine) with a fixed key defined in configuration. There are differences between the WaterBear downloader and other downloaders such as Deuterbear. Some WaterBear downloaders have been observed using command-and-control (C&C) servers with internal IP addresses, an unusual tactic that adds another layer of obfuscation. For a more comprehensive view of WaterBear's past activities, please refer to the 2019 report by Trend Micro. The latest iteration of WaterBear, known as Deuterbear, exhibits even more advanced techniques, demonstrating the continuous evolution of this malware. This report will delve into the latest techniques Earth Hundun has implemented with WaterBear and provide an analysis of Deuterbear.