Clop is a Windows ransomware family that behaves very differently depending on how it is started. These notes cover what I saw while stepping through a handful of recent builds.
Three ways to run it
The sample reads its first command-line argument and picks a mode. The mode names below are the strings I found in the binary.
clop.exe runrun -> encrypt network drives only
clop.exe temp.ocx -> encrypt only the folders listed inside temp.ocx
clop.exe -> no argument: install a service, then
encrypt local disks AND network shares
Running with no argument is the interesting path. The binary registers itself as a service first and starts encrypting from there, so the work continues even if the launching process is killed.
What it does before encrypting
- It holds an embedded public key, so files can be locked without any key exchange with the operator.
- It carries a list of process names to terminate, which frees file handles held by databases, backup agents and office tools.
- It creates a named mutex so only one copy runs.
- Share discovery uses the classic Windows network enumeration calls, which means mapped and unmapped shares on the local network are both fair game.
Encryption and the note
Each file is processed by a custom routine and a plain-text readme is written to the folders it touches while encryption is running. Because the note appears early, a monitoring rule that watches for the sudden spread of a new text file across many directories fires well before the job is finished.
Things to look for
service : new auto-created service pointing at a user-writable path
processes : burst of taskkill-style terminations of DB / backup tools
files : same readme name appearing in many folders within seconds
network : SMB share enumeration from a workstation that never did it before
Sample hashes from my notes
968307a367471e25bef58b0d4687ab4fdf34539bbfb603b5b19ae99d4d0c0340
a5a11f16cafa9e127309b688a136ae9ff2a1c95f481fa523a9551f000a8f8d7e
2c9b1d62ab1de35ac46145967b5c2692aea158a87a11142d43b9dc697ce51798