���L�c(�/�fg-L�?����ӓ��&�dCW-Xp4�����_}h�5�>&��+�0[#D���3��֩2����c���@��؇�[6�R�B+�AU��=0�M��2 6�ᒉW� Ap��o,��Ǽ�Z���D�����%���xxHW$4���X����a|����}���M6-�j!�}� d�9䝽�-�\X����&�ѕg:��$�FA��;�Pc��Iµ�\|>P��P���(�Z����sT��w���J�H�庒&�]KH(K��A�������2�S�^+�E�5g�"�'S|!��<�6@C`�1�G����,2���M�9BɕlX1�E���҅����ܐ��]��c��/x�lA����y�@�<8��68�'���\�y;Jib;����\�~丽5����ʩQ�{��M�]3�� ؍ 4�]S�R�����8 �R.LxZ�'��U7S3O�o��|��#C��7���� Z�p@c�r�G�����Z�ud�t���,G��TX���_;wf�$1�2Ǩ��%�^o8����:�d�`���V�D�����8�* ڲ���b/�B���K�QC�QV��ηhP�}��*�t��T�Ih��!7X�9���B`:sC0M LȇøZ,&�l?&��Y�A�{���(ў<�]ΒG`�m^�D&1����3h4��e�:������Fع�<k���N*@�u �uk���L! }pl�\c���K/�|B��[{�"`d�sM��)����跺B�D���+2�M%�嬞9 :�i��=P\�F�������3HJeØ��/� ޔD6@�;���x�u?8R�.�Xp���6Q���X.��;z�[]S��D)�J�<y_��Oӗ!}c8�Gw���P��!�UM�y��Q�������i��',�C`���\O�^ ���2!阄�/�d�(���)NI�X�y��Չ�S)�tN�#D�խ���V�o��ݧ��b-����-^@�@���1Yr����ze���j��C�z>����Ԏ���s��3J��D�#�V����8_���KN�3#3�Ŗ8��8q������� ;"?@�������즃I�y��vڒY������z�|���y���<cpn@zMߕ�<�P�X��� ��n'�Z� 2���F�q�:D 5�l����;����VI�њ�ڪgT��X�y��$�%����ˇJ��Z�dҌ�����A{G^��Ѫ%B8T��Zȸ�X�`������������w��O�@yG�B(O��vtVyK1�s�z�k�����݉� �J˜����Ɏ��>�S SɅ� �O��6��Z��D�{A�S;�B֗T��~�ǟ�Qy�~�"!Y�;��Ӗ��g} H:$yz^~�c�a/��a袽 �e��}���e���+��дo(�Y���M�h�C�@�.2�֜xD��D���p�}��"�/���&�z�^�%7�!JF���Y�Y��G�� ��3�-�� ��fa V�x=��A�4܂���'ע�w{�FZ9��Vƿ��#�7�W����3<�2h��*<����ֿ�(��sSj$DW����A���=�&v�L�D����Gk���[7�`��\MD1�bt�S��Փ��7������tß�ga��@L��65�ݢ0~&5����p'�A0DU6;>=��y��눢A�(F0'̎������zH��F��������?)���g֞��Y ����� �<�}�.�� ��� u�2�ӋtUCt�̊�u*�j^J�T�C�y�+�UM�R/�F��?5��Vi�N�ߝW3'�B�b����'O����֫�Jp��z���I� �R .5�/�� c�D(~t慦���ك���~�� 8�������ޔ���Z���^�C\�Q���L��ř>(�G��?� = � ��/����� ��JFؑ\R�c�3���d��. ŷ bI�g���Џ`��Q���B!(���<)��Ջ�pJ�sF�woM*��Z3� Mu֚�0]ě %�;�ٵk�i�+t�M������^j�p8P�*R��H����J��J�%�~w��jF�[��64�8�� Y'��dg!4�Gg�G7�*��ājO����|�k%�7�'\�K�g�qA/�� 6p��8�`=������7H館e���ۤ^6�\P�� ����������c��$�<��ɢx��[��{M�|9��IǶ|1�A|�OX�I]R��������r�"��)8�������h�y��~f�a� ��-����'�s���W7����9�*#4��f8��[�`!��0��4����Y1!��� }���OR3�T��,@�u|�tV���+ծ�z�u�xj�]��CY��[g�Ab��O�줯��3�2��0:�� ƨŀL14�E��0���~v ��J� V��zǵY�.�1�2#��Ԑ�j�3�o�Rn8i�)� �iW�bl�H�#, �����?�����M9�*-ꕃ�Y��^U����H�$��P+���9GB��>9�zkң��F�9A<�3 3�]�����t9�]q�}��_A>muO��%�%��*�Ѥ�c�����c��^��iEG__�3�߃��Z �d�ݚ<�~Q�i_||��χC�.ɸ]�0�R{��j��k�Z !����mS�:AZ6�up?��K��m}�$�|�Ւ�'^+��8é��� h�$z��)��.�o��L�>��K�{��;`��jB��a�~�P�o,�e�AF;��_1���������B�yh�r��.�r|'���o�=���wH�����C%:w9v�����z�x'�ju'��G����i+��8Ċ��������fX�WA�cЧq�L盈�rM)��x���7�3��9�ѷ�G�|yƍ{�:c/�l����j���T(��]�%D���LF�t���麒����Z�Y���=��uʊ�W�We� -4�pYŗ�-ͣ��U Vٔ^ D�"��>D$�a�")ՀSOBX*,i6�ᏠR6_�i�z�D��\�#U��*�|��ӹ��F5-����L�8u.Pq~��fj:��0w\-s��
Static task
static1
Behavioral task
behavioral1
Sample
Clover_Permanent_Spoofer.exe
Resource
win11-20231215-en
General
-
Target
Clover_Permanent_Spoofer.exe
-
Size
5.7MB
-
MD5
f56a23093b3f8151926520c0a7323faa
-
SHA1
62b3fca6786971ceabb9717c9854f37b357028b5
-
SHA256
aea025626366cd0ac0e794f8ea733576a108be9d33b92143929b77a62d73d88c
-
SHA512
d03545397930e96ed069af3e8cd9c42172d0de09c859e3513e6c800679b9c27b384caf2326846946719d8237cdbff3323257c00573941659d332b44ed3cb2eff
-
SSDEEP
98304:gnb4A/tZ8OqbZSvikqGrmqNkazgmELW9khvOew5X0sPC956RHt2e+paT:2tSb6rqGFKazgTW9Uv5w9PC95EN2e+2
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Clover_Permanent_Spoofer.exe
Files
-
Clover_Permanent_Spoofer.exe.exe windows:6 windows x64 arch:x64
3382945bf7860bec7d0c4ae5258edac3
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
ReadFile
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
ShowWindow
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
RegCloseKey
shell32
ShellExecuteA
secureenginesdk64
ord551
msvcp140
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
winhttp
WinHttpCloseHandle
normaliz
IdnToAscii
wldap32
ord46
crypt32
CertFreeCertificateChain
ws2_32
closesocket
shlwapi
PathFindFileNameA
rpcrt4
UuidToStringA
psapi
GetModuleInformation
userenv
UnloadUserProfile
imagehlp
ImageNtHeader
wininet
InternetCloseHandle
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-filesystem-l1-1-0
_access
api-ms-win-crt-string-l1-1-0
strncpy
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-environment-l1-1-0
getenv
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
&J4mBi0> Size: - Virtual size: 749KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
a`_!8Mk( Size: - Virtual size: 146KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
jlP3CI9c Size: - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
zHJaA_#( Size: - Virtual size: 36KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
qcHqX@F- Size: - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
KS^jV/wq Size: - Virtual size: 24B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
#GNyO/O% Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
edY5hFqz Size: 5.7MB - Virtual size: 5.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
y27^'x4i Size: 512B - Virtual size: 236B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
"(WpofoK Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ