Trojan.Belonard — Indicators of compromise

Samples

All hashes are SHA1

client.dll

ce9f0450dafda6c48580970b7f4e8aea23a7512a - Trojan.Belonard.1

Mp3enc.asi

75ec1a47404193c1a6a0b1fb61a414b7a2269d08 - Trojan.Belonard.2
4bdb31d4d410fbbc56bd8dd3308e20a05a5fce45 - Trojan.Belonard.2

Mssv16.asi

72a311bcca1611cf8f5d4d9b4650bc8fead263f1 - Trojan.Belonard.3
2bf76c89467cb7c1b8c0a655609c038ae99368e9 - Trojan.Belonard.3
d37b21fe222237e57bc589542de420fbdaa45804 - Trojan.Belonard.3
6b03e0dd379965ba76b1c3d2c0a97465329364f2 - Trojan.Belonard.3

Mssv24.asi

15879cfa3e5e4463ef15df477ba1717015652497 - Trojan.Belonard.5
4b4da2c0a992d5f7884df6ea9cc0094976c1b4b3 - Trojan.Belonard.5
6813cca586ea1c26cd7e7310985b4b570b920803 - Trojan.Belonard.5

Mssv36.asi

a0ea9b06f4cb548b7b2ea88713bd4316c5e89f32 - Trojan.Belonard.10

FileSystem.asi

e6f2f408c8d90cd9ed9446b65f4b74f945ead41b - Trojan.Belonard.11

spwinres.dll

a77d43993ba690fda5c35ebe4ea2770e749de373 - Trojan.Belonard.4

davapi.dll

73ba54f9272468fbec8b1d0920b3284a197b3915 - Trojan.Belonard.6
a057bc2910dd38b01390aaa3c8b73b436d695539 - Trojan.Belonard.6
d6f2a7f09d406b4f239efb2d9334551f16b4de16 - Trojan.Belonard.6
0261dd7fe117729a345ea048ec834d22950f7b23 - Trojan.Belonard.6
db4d0e71590ac6da3f5a4af000c871db4f48c8fb - Trojan.Belonard.6
002320bcabd497da9872b0ee723acfede52840a7 - Trojan.Belonard.6

WinDHCP.dll

8165872f1dbbb04a2eedf7818e16d8e40c17ce5e - Trojan.Belonard.7
027340983694446b0312abcac72585470bf362da - Trojan.Belonard.7

wmcodecs.dll

89dfc713cdfd4a8cd958f5f744ca7c6af219e4a4 - Trojan.Belonard.8
93fe587a5a60a380d9a2d5f335d3e17a86c2c0d8 - Trojan.Belonard.8

ssdp32.dll

2420d5ad17b21bedd55309b6d7ff9e30be1a2de1 - Trojan.Belonard.9
dc7dda9cd9ccd74f65dc517aa7a9e80d5190c786 - Trojan.Belonard.9
1a351e271bd74aa5d98dd544597740802fca4fda - Trojan.Belonard.9

Network indicators

Domains

csgoogle.ru
etmpyuuo.csgoogle.ru
jgutdnqn.csgoogle.ru
hl.csgoogle.ru
half-life.su
play.half-life.su
valve-ms.ru
bmeadaut.valve-ms.ru
fuztxhus.valve-ms.ru
ixtzhunk.valve-ms.ru
oihcyenw.valve-ms.ru
suysfvtm.valve-ms.ru
wcnclfbi.valve-ms.ru
reborn.valve-ms.ru
valve.ms
csfsblue.ru
okxxdigs.csfsblue.ru
smuwccfn.ru
etpfnniu.ru
zpnkqkgv.ru
mwprnvlu.ru
xfxjuwru.xyz
bekauyrk.xfxjuwru.xyz
snsrsfay.xfxjuwru.xyz

IPs

37.143.12.3
46.254.17.165
160.20.147.81
162.246.23.169
88.198.131.212