Packer: VMProtect
Compilation date: 2018.10.25 20:36:03
SHA1:
- 76a149cab53c6a438e3f6ec0e2b5b613bea1f6a7 (client.dll)
Description
Trojan.Belonard.1 is part of the Belonard trojan. It gets uploaded to a victim’s device through an RCE-vulnerability.
Operating routine
Once on the victim’s device, Trojan.Belonard.1 deletes any .dat files that are in the same directory with the library process file. After that, it connects to the command and control server fuztxhus.valve-ms[.]ru:28445. All traffic transmitted between the trojan and C&C server is encrypted.
Encryption/decryption algorithm:
import socket, random
def encbuf(data):
c = random.randint(11, 245)
d = random.randint(11, 245)
e = random.randint(11, 245)
f = random.randint(11, 245)
enc_r = ''
y = c
z = c
for i in range(len(data)):
y = (ord(data[i]) + f*z + e*y + d)&0xff
z = ord(data[i])
enc_r += chr(y & 0xff)
enc_r = '\x00\x00%c%c%c%c%s' % (f,e,d,c,enc_r)
return f,e,d,enc_r
def decbuf(f,e,d,enc):
y = ord(enc[0])
dec = ''
for i in range(1,len(enc)):
y = (ord(enc[i]) - e*ord(enc[i-1]) - f*y - d)&0xff
dec += chr(y)
return dec
The trojan sends the following request to download the Mp3enc.asi file: \x01GET /Mp3enc.asi HTTP/1.1\r\n\r\n.
Decrypted response from the server:
