Packer: VMProtect
Dates of compilation and SHA1 hashes:
- 15879cfa3e5e4463ef15df477ba1717015652497 - 07.08.2017 00:47:36
- 4b4da2c0a992d5f7884df6ea9cc0094976c1b4b3 - 28.12.2017 21:37:02
- 6813cca586ea1c26cd7e7310985b4b570b920803 - 21.10.2018 11:25:07
Description
Trojan.Belonard.5 is part of the Belonard trojan. The original name is fiveseven_reload_clipin_sliderelease.dll. This library has three exported functions: "CreateInstance", "xW” and "yW". Trojan.Belonard.5 can be created by files Mssv36.asi (Trojan.Belonard.10) and Mssv16.asi (Trojan.Belonard.3). The trojan runs Mssv16.asi via rundll32: It downloads and runs Mssv16.asi (Trojan.Belonard.3).
Operating routine
Trojan.Belonard.5 receives information about the running process and paths to the module in DllMain. If the process name is not rundll32.exe, it starts a separate thread for subsequent actions.
In the running thread, Trojan.Belonard.5 creates the key [HKCU\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers] '<path to the executable file process>', assigns it the value “RUNASADMIN”, and checks the module name. If the name matches “Mssv24.asi”, it calls its exported function “y”; if not, it copies itself into the Mssv24.asi file and runs the exported function "x” of that file, passing a path to the current module as a parameter. After that, it runs the exported function “y”, passing to it the path to the Mssv24.asi file.
In the “yW” exported function the library decrypts the address of the C&C server, fuztxhus.valve-ms[.]ru.
Decryption algorithm:
def decrypt(data):
s = 'f'
for i in range(0,len(data)-1):
s += chr((ord(s[i]) + ord(data[i]))&0xff)
print s
The algorithm was changed in later versions of the trojan, but the C&C server’s address remains the same.
New decryption algorithm:
def decrypt(d):
s = ''
c = ord(d[0])
for i in range(len(d)-1):
c = (ord(d[i+1]) + 0xe3*ord(d[i])-0x0d*(c+4)) & 0xff
s += chr(c)
return s
The trojan then checks if the Wow64 process is running. Based on the check results, it chooses either the 28821 or 28822 port and connects to the server to receive an executable file. The first DWORD in the buffer indicates the size of the executable MZPE file. The trojan then saves the MZPE file in the Mssv16.asi (Trojan.Belonard.3) and changes the created/modified/accessed dates of the file to the same date of one of the components: Mssv12.asi, Mssv29.asi, Mss32.dll, hl.exe.
The trojan runs Mssv16.asi via rundll32:
rundll32.exe 0 "Mssv16.asi",xIn its exported function, “xW” receives a path as an argument, and then deletes the file located in that path.
In its exported function, “CreateInstsance” returns 1.
