Technical Information
Malicious functions
Registers BHO
- [<HKLM>\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F8A6CAA2-533D-4AED-9E05-8EB19A4021AB}]
Modifies file system
Creates the following files
- %TEMP%\aut1831.tmp
- %ProgramFiles(x86)%\clover\tabhelper64.dll
- %ProgramFiles(x86)%\clover\lang\uires_chs.dll
- %ProgramFiles(x86)%\clover\lang\uires_de.dll
- %ProgramFiles(x86)%\clover\lang\uires_en.dll
- %ProgramFiles(x86)%\clover\lang\uires_es.dll
- %ProgramFiles(x86)%\clover\lang\uires_fr.dll
- %ProgramFiles(x86)%\clover\lang\uires_jp.dll
- %ProgramFiles(x86)%\clover\lang\uires_nl.dll
- %ProgramFiles(x86)%\clover\lang\uires_pt.dll
- %ProgramFiles(x86)%\clover\ssleay32.dll
- %ProgramFiles(x86)%\clover\tabhelper32.dll
- %ProgramFiles(x86)%\clover\lang\uires_ru.dll
- %ProgramFiles(x86)%\clover\官方网站.url
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\clover\在线升级.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\clover\clover.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\clover\卸载.lnk
- C:\users\public\desktop\clover.lnk
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\clover.lnk
- %APPDATA%\microsoft\internet explorer\quick launch\clover.lnk
- %TEMP%\aut6ef9.tmp
- %ProgramFiles(x86)%\clover\lang\uires_tr.dll
- %ProgramFiles(x86)%\clover\lang\uires_tw.dll
- %ALLUSERSPROFILE%\microsoft\windows\start menu\programs\clover\官方网站.url
- %ProgramFiles(x86)%\clover\login_ui.dll
- %ProgramFiles(x86)%\clover\libeay32.dll
- %ProgramFiles(x86)%\clover\duilib_u.dll
- %CommonProgramFiles(x86)%\clover\clover.ini
- %TEMP%\my7zdata.7z
- %LOCALAPPDATA%low\clover\config\usevestige.ini
- %ProgramFiles(x86)%\clover\ico\baidu.png
- %ProgramFiles(x86)%\clover\ico\jd.png
- %ProgramFiles(x86)%\clover\ico\taobao.png
- %ProgramFiles(x86)%\clover\reg.bat
- %ProgramFiles(x86)%\clover\unreg.bat
- %ProgramFiles(x86)%\clover\lang\lang_index.xml
- %ProgramFiles(x86)%\clover\cloverinfo.ini
- %CommonProgramFiles(x86)%\~qwtfyfj.tmp
- %ProgramFiles(x86)%\clover\appconfig.dat
- %ProgramFiles(x86)%\clover\default.dat
- %ProgramFiles(x86)%\clover\data\__.dat
- %ProgramFiles(x86)%\clover\data\____.dat
- %ProgramFiles(x86)%\clover\clover.exe
- %ProgramFiles(x86)%\clover\helper.exe
- %ProgramFiles(x86)%\clover\softupd.exe
- %ProgramFiles(x86)%\clover\uninst.exe
- %ProgramFiles(x86)%\clover\utility.exe
- %ProgramFiles(x86)%\clover\cloverflush.dll
- %ProgramFiles(x86)%\clover\clover_dll.dll
- %ProgramFiles(x86)%\clover\appnode.dat
- %TEMP%\aut6f19.tmp
- %ProgramFiles(x86)%\clover\config.ini
Sets the 'hidden' attribute to the following files
- %CommonProgramFiles(x86)%\~qwtfyfj.tmp
Deletes the following files
- %TEMP%\aut1831.tmp
- %TEMP%\my7zdata.7z
- %TEMP%\aut6ef9.tmp
- %TEMP%\aut6f19.tmp
Network activity
Connects to
- 'tj##.ejie.me':80
- 'tj.#jie.me':80
- 'co###g.ejie.me':80
TCP
HTTP GET requests
- http://tj##.ejie.me/statistics/cloversoftlist?co#################################################################################################################################################...
UDP
- DNS ASK tj##.ejie.me
- DNS ASK tj.#jie.me
- DNS ASK co###g.ejie.me
Miscellaneous
Searches for the following windows
- ClassName: 'Clover_WidgetWin_0' WindowName: ''
Creates and executes the following
- '%CommonProgramFiles(x86)%\~qwtfyfj.tmp' /S
- '%ProgramFiles(x86)%\clover\utility.exe' InstallSpreadOperate gf210727,,0
- '%ProgramFiles(x86)%\clover\utility.exe' InstallServiceDriver
- '%ProgramFiles(x86)%\clover\utility.exe' CreateStartMenu 1
Executes the following
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%ProgramFiles(x86)%\Clover\\TabHelper32.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s /u "%ProgramFiles(x86)%\Clover\\TabHelper64.dll"
- '<SYSTEM32>\regsvr32.exe' /s /u "%ProgramFiles(x86)%\Clover\\TabHelper64.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Clover\\TabHelper32.dll"
- '%WINDIR%\syswow64\regsvr32.exe' /s "%ProgramFiles(x86)%\Clover\\TabHelper64.dll"
- '<SYSTEM32>\regsvr32.exe' /s "%ProgramFiles(x86)%\Clover\\TabHelper64.dll"
