Trojan.Belonard.3

Packer: WinLicense

SHA1:

• 72a311bcca1611cf8f5d4d9b4650bc8fead263f1 (Mssv16.asi, x86)
• 2bf76c89467cb7c1b8c0a655609c038ae99368e9 (Mssv16.asi, x86)
• d37b21fe222237e57bc589542de420fbdaa45804 (Mssv16.asi, wow64)
• 6b03e0dd379965ba76b1c3d2c0a97465329364f2 (Mssv16.asi, wow64)

Description

Trojan.Belonard.3 is part of the Belonard trojan. Its original name is Mssv16.asi; the name used when compiled is Mssv16.dll. This malicious library has two exported functions: «xW» and «yW». It gets uploaded to a victim’s device either by Trojan.Belonard.5 or Trojan.Belonard.5. It creates and runs WinDHCP.dll (Trojan.Belonard.7) or davapi.dll (Trojan.Belonard.6).

Operating routine

In DllMain, it deletes the Mssv24.asi (Trojan.Belonard.5) file and then checks the process in the context of which it runs. If it’s not rundll32.exe, the library calls its exported function “y” via rundll32.exe. Depending on whether the WinDHCP (Trojan.Belonard.7) service is running, the library calls another exported function. Function “yW” installs the service if there’s a flag indicating the necessity. Function “xW” installs the service also in the case it’s not running.

The library creates mutual exclusion «Counter-Strike 1.6» and extracts the file Mssv24.asi (the file is not used in the trojan since 10/21/2018). After that, the trojan changes the created/modified/accessed dates of the file to the same date of one of the Mssv12.asi, Mssv29.asi, Mss32.dll or hl.exe components. The trojan calls its exported function “x” via rundll32.

In order to install the WinDHCP service, the trojan stores WinDHCP.dll and davapi.dll files into the system32 directory. Unlike Mssv24.asi, those files are stored within the trojan in a disassembled form. The bodies of these two trojans are divided into blocks of 0xFFFC bytes (the last block may be smaller). When saved to disk, the trojan assembles the blocks together to obtain working files.

Having assembled the trojans, Trojan.Belonard.3 creates the WinDHCP service to run WinDHCP.dll (Trojan.Belonard.7) in the context of svchost.exe. Depending on language settings, the OS uses texts in Russian or English to set service parameters.

WinDHCP service parameters:

• Service name: “Windows DHCP Service” or “Служба Windows DHCP”;
• Description: “Windows Dynamic Host Configuration Protocol Service” or “Служба протокола динамической настройки узла Windows”;
• The ImagePath parameter is specified as %SystemRoot%\System32\svchost.exe -k netsvcs, while ServiceDll specifies the path to the Trojan library.

Modules of the trojan and corresponding dates of compilation

• News about the Trojan
• Research on the Belonard trojan