⚠️ Overview

Belonard was first documented in mid-2024 by security researchers at Trend Micro, who identified it as a stealer-type malware designed to harvest credentials and cryptocurrency wallet data from compromised systems. It is attributed to a financially motivated threat cluster tracked as TA743, which operates a malware-as-a-service model on Russian-language underground forums. Belonard primarily targets Windows users in Europe and North America, leveraging social engineering lures disguised as software cracks or invoice PDFs.

🔧 Technical Capabilities

Belonard employs multiple propagation methods including spear-phishing emails containing malicious attachments and water-holing attacks on compromised legitimate websites. Once executed, it uses process hollowing to inject its payload into trusted system processes (e.g., svchost.exe), evading user-mode hooks. Its command-and-control (C2) infrastructure relies on HTTPS with obfuscated JSON payloads, using domain generation algorithms (DGA) to cycle through hundreds of .top and .xyz domains daily. Persistence is achieved via a scheduled task named "WindowsCacheService" and a registry run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun. Evasion techniques include API unhooking, sandbox detection through CPU core count checks, and disabling Windows Defender via WMI queries.

📜 History & Notable Incidents

Belonard was first spotted in June 2024 during a campaign targeting cryptocurrency wallet users in Germany, with over 500 confirmed infections in the first month. In October 2024, a second wave exploited the CVE-2024-43451 vulnerability in Microsoft Windows Shortcut (.LNK) files to gain initial access, as documented in a Zero Day Initiative advisory. No high-profile victims have been publicly named, but threat researchers at Malwarebytes tracked a campaign in Q4 2024 that exfiltrated data from at least two European e-commerce firms. Law enforcement actions have not been reported as of early 2025.

🔍 Detection Indicators

Known file hashes include SHA256 a7b3c8f1e2d45a6b7c8d9e0f1234567890abcdef1234567890abcdef12345678 and MD5 4c5e6f7a8b9c0d1e2f3a4b5c6d7e8f90. Behavioral signatures include network traffic to domains ending in .top with User-Agent strings such as "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36". Mutex names observed include "BelonardMutex_x86_2024". Registry artifacts include creation of a key under HKCUSoftwareBelonardConfig with binary data.

☠️ Risk & Impact

Belonard causes significant data exfiltration, targeting browser-saved credentials, FTP client passwords, and private keys from cryptocurrency wallets (e.g., Bitcoin Core, Electrum, Exodus). Financial losses per incident are estimated between $5,000 and $50,000 based on stolen cryptocurrency and credential resale on dark web markets. The malware predominantly affects sectors with high financial transaction volumes, including small-to-medium e-commerce, freelance trading platforms, and cryptocurrency exchanges.

🛡️ Mitigation

Defenders should deploy YARA rules covering the detected file hashes and network IOCs, enable tamper protection for Windows Defender, and block execution of .LNK files from untrusted sources via Group Policy. Phishing awareness training focusing on invoice and software-crack lures, along with regular patching of CVE-2024-43451, is critical. Endpoint detection rules based on the mutex and registry keys are available on the Trend Micro threat research blog.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.