Malware analysis report: WinDealer (LuoYu Threat Group)

WinDealer is a type of malware that is used for financial fraud and theft. It is a banking Trojan that is designed to steal sensitive financial information, such as login credentials, credit card numbers, and other personal information from victims’ computers.

Following are the capabilities of the malware:

• Manipulation of files and file systems: reading, writing, and deleting files, listing directories, and collecting disk information


• Information collection: gathering device details, network settings, and/or keyboard layout, listing running processes, installed software, …

analysis banking banking trojan capabilities card computers credentials credit credit card file files financial financial fraud fraud information login login credentials luoyu malware malware analysis manipulation numbers personal personal information report steal theft threat threat group trojan windealer