Ransom.Win32.CLOP.D

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Instalación

Infiltra los archivos siguientes:

• {Malware path}\clearsystems-11-11.bat

Agrega las siguientes exclusiones mutuas para garantizar que solo se ejecuta una de sus copias en todo momento:

• Fany---Fany---6-6-6

Técnica de inicio automático

Inicia los servicios siguientes:

• Service Name: ProcessNetworkSecurity

Finalización del proceso

Finaliza los procesos siguientes si detecta que se ejecutan en la memoria del sistema afectado:

• WINWORD.EXE
• EXCEL.EXE
• THEBAT.EXE
• THEBAT64.EXE
• THUNDERBIRD.EXE
• VISIO.EXE
• WORDPAD.EXE
• MSFTESQL.EXE
• SQLWRITER.EXE
• ORACLE.EXE
• XFSSVCCON.EXE
• OCAUTOUPDS.EXE
• MYDESKTOPQOS.EXE
• MYSQLD-NT.EXE
• MYSQLD-OPT.EXE
• AGNTSVC.EXEAGNTSVC.EXE
• OUTLOOK.EXE
• POWERPNT.EXE

Otros detalles

Cifra los archivos con las extensiones siguientes:

• {file name}.{file extension}.Clop

Hace lo siguiente:

• This Ransomware will delete itself:
  • If Keyboard layout are the following:
    • Georgian
    • Russian
    • Tajik
    • Belarusian
    • Armenian
    • Azeri
    • Kazak
    • Kyrgyz
  • If default language ID are the following:
    • Russian
• It will drops and executes "{Malware path}\clearsystems-11-11.bat" if the following process are not found:
  • SBAMTray.exe
  • SBPIMSvc.exe
  • SBAMSvc.exe
  • VipreAAPSvc.exe
  • WRSA.exe
• Executes the following commands to edit the boot configuration data file:
  • bcdedit /set {default} recoveryenabled No
  • bcdedit /set {default} bootstatuspolicy ignoreallfailures
• Executes the following commands to delete and resize the shadow copies:
  • vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
  • vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
  • vssadmin Delete Shadows /all /quiet
• It encrypts all files except the following:
  • Clopreadme.txt
  • ntldr
  • NTLDR
  • boot.ini
  • BOOT.INI
  • ntuser.ini
  • NTUSER.INI
  • AUTOEXEC.BAT
  • autoexec.bat
  • .Clop
  • NTDETECT.COM
  • ntdetect.com
  • .dll
  • .DLL
  • .exe
  • .EXE
  • .sys
  • .SYS
  • .OCX
  • .ocx
  • .LNK
  • .lnk
  • desktop.ini
  • autorun.inf
  • ntuser.dat
  • iconcache.db
  • bootsect.bak
  • ntuser.dat.log
  • thumbs.db
  • DESKTOP.INI
  • AUTORUN.INF
  • NTUSER.DAT
  • ICONCACHE.DB
  • BOOTSECT.BAK
  • NTUSER.DAT.LOG
  • THUMBS.DB
• It encrypts files located in the following locations:
  • Removable Drives
  • Fixed Drives
  • Shared Drives
• the batch file "{Malware path}\clearsystems-11-11.bat" contains the following strings:
  • vssadmin Delete Shadows /all /quiet
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
    vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
    vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
    vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
    vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
    vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
    vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
    vssadmin Delete Shadows /all /quiet
    bcdedit /set {default} recoveryenabled No
    bcdedit /set {default} bootstatuspolicy ignoreallfailures