Ransom.Win32.CLOP.NV

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It drops files as ransom note. It avoids encrypting files with the following file extensions.

Arrival Details

This Ransomware arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

This Ransomware drops the following files:

• {Original Filename w/ Extension}.CIIp → Contains Encrypted Encryption Key.

It adds the following processes:

• {Malware Full Path} runrun

It adds the following mutexes to ensure that only one of its copies runs at any one time:

• ProgramPro#666#666#667

Other Details

This Ransomware does the following:

• It will only proceed to its malicious routine if it is ran as a service.
• It encrypts FIXED and REMOVABLE drives.
• It will attempt to encrypt found Remote Shared Folders.
• It encrypts files depending on their filesize:
  • For files with a size that is less than or equal to 17 kilobytes (0x4268 bytes), it will skip encrypting these files.
  • For files with a size that is greater than 17 kilobytes (0x4268 bytes) but less than 2.13 MB (0x‭2089D0 bytes‬), it would encrypt the file from the 0x4000 position to the end of file.
  • For files with a size that is greater than 2.13 MB (0x‭2089D0 bytes‬), it would encrypt the file from the 0x10000 position to the 0x‭2089D0 position.
• Its keystore file ({Original Filename w/ Extension}.CIIp) contains the following:
  • Cllp^_-{Encrypted Encryption Key}

It accepts the following parameters:

• runrun → Encrypt only Remote Shared Folders
• temp.ocx → Read the contents of temp.ocx and Encrypt only filepaths listed inside.

Ransomware Routine

This Ransomware avoids encrypting files with the following strings in their file name:

• README_README.txt
• AUTOEXEC.BAT
• AUTORUN.INF
• BOOT.INI
• BOOTMGR.BAT
• BOOTSECT.BAK
• DESKTOP.INI
• ICONCACHE.DB
• NTDETECT.COM
• NTUSER.DAT
• NTUSER.DAT.LOG
• NTUSER.INI
• THUMBS.DB

It avoids encrypting files with the following strings in their file path:

• \Desktop
• \DESKTOP
• $RECYCLE.BIN
• AHNLAB
• ALL USERS
• APPDATA
• BOOT
• BOOTMGR
• CHROME
• DEFAULT
• LOCAL SETTINGS
• MICROSOFT
• MOZILLA
• NTLDR
• PERFLOGS
• PROGRAM FILES
• PROGRAM FILES (X86)
• RECOVERY
• SOPHOS
• SYSTEM VOLUME INFORMATION
• TOR BROWSER
• WINDOWS
• WINNT

It drops the following file(s) as ransom note:

• {Encrypted Directory}\README_README.txt
  

It avoids encrypting files with the following file extensions:

• .CIIP
• .bat
• .cmd
• .ttf
• .lng
• .hlf
• .chm
• .msi
• .ini
• .ico
• .LNK
• .SYS
• .EXE
• .DLL
• .OCX
• .CI0P