Red_Nue__2021__Malware_WinDealer_used_by_LuoYu_Attack_Group_-_JPCERT_CC_Eyes_JPCERT_Coordination_Center_official_Blog.pdf

This report analyzes the WinDealer malware used by the LuoYu attack group, outlining its architecture, data-collection and exfiltration workflow, C2 communications, configuration encoding, memory-resident DLL loading, and the associated command and control infrastructure, with extensive appendices detailing configurations, data formats, and potential indicators.