clop | Trojan-Ransom[.]Win32[.]KlopRansom[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Trojan-Ransom.Win32.KlopRansom.exe
Size 112KB
Sample240716-vbza1svbma
SHA256 6b3a6afb6edc1c9d36e0793f00be3c0cf6626db26b3cfd31d6a18793453303a7
MD5 3ea56f82b66b26dc66ee5382d2b6f05d
SHA1 2bd49980b7337db927e0d4108d447574b412950a
SHA512 c43d1be852af42f00a13acacc514f53c5e74ce3df0e8cd39fce3ca043082004d11c3021b81cc900282ccb1028b951a052e0b74c215104748e8b5db17294fccc3
SSDEEP 3072:Se+AWHmhCmRcjx2ScawbA3CGFmzwxHPnEH7:Se9hKUo18kJnEH7
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

clop

Malware Config

Signatures

Clop family
clop

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Trojan-Ransom.Win32.KlopRansom.exe

File Explorer

Trojan-Ransom.Win32.KlopRansom.exe

.exe 112KB

Trojan-Ransom.Win32.KlopRansom.exe

IMPHASH f33c7aaba5188ab257bafef74b9ebf68
SHA256 6b3a6afb6edc1c9d36e0793f00be3c0cf6626db26b3cfd31d6a18793453303a7
MD5 3ea56f82b66b26dc66ee5382d2b6f05d
SHA1 2bd49980b7337db927e0d4108d447574b412950a
SHA512 c43d1be852af42f00a13acacc514f53c5e74ce3df0e8cd39fce3ca043082004d11c3021b81cc900282ccb1028b951a052e0b74c215104748e8b5db17294fccc3
SSDEEP 3072:Se+AWHmhCmRcjx2ScawbA3CGFmzwxHPnEH7:Se9hKUo18kJnEH7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4663

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcpyA GlobalFree CloseHandle CreateThread MoveFileExW lstrcpyW CreateFileMappingW MapViewOfFile lstrcmpW GetShortPathNameA GetModuleFileNameA BeginUpdateResourceA EraseTape FindFirstVolumeW GetProfileSectionW GetCurrentProcess lstrlenW CancelDeviceWakeupRequest TerminateProcess GlobalUnWire GetConsoleTitleW EnumResourceNamesW CreateMutexW OpenFile GetEnvironmentVariableA EnumSystemCodePagesW CancelThreadpoolIo GlobalDeleteAtom QueryMemoryResourceNotification GetACP OpenProcess FindFirstVolumeMountPointA FindActCtxSectionStringA CreateToolhelp32Snapshot CreateEventW Sleep GetLastError GetConsoleAliasesLengthW Process32NextW CreateFileA SetEvent DefineDosDeviceA DeleteFileW GetCurrentThread GetSystemDirectoryA Process32FirstW GlobalFindAtomW QueueUserAPC LocalSize FindAtomA ExitProcess FreeLibrary GetSystemTime GlobalUnlock GetDriveTypeW FindFirstFileTransactedA CreateTimerQueue SizeofResource GetCurrentDirectoryA LockResource LoadResource FindResourceW GetModuleHandleW DecodePointer WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap GetStringTypeW GlobalAlloc ReadFile lstrcatW GetFileType SetStdHandle OutputDebugStringW SetFileAttributesW UnmapViewOfFile CreateFileW WaitForSingleObject FindClose lstrlenA SetFilePointer SetErrorMode VirtualAlloc LCMapStringW WriteFile FindNextFileW VirtualFree FindFirstFileW GetSystemFileCacheSize UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetProcAddress LoadLibraryExW GetStdHandle MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW HeapFree HeapAlloc FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

GetWindowTextW wsprintfW GetDC EqualRect wsprintfA DestroyIcon GetKeyboardLayout EnumWindows CharUpperBuffW GetDesktopWindow GetLastActivePopup

gdi32

CreateDIBPatternBrush GetTextCharset

winspool.drv

OpenPrinterA

advapi32

RegisterServiceCtrlHandlerW CryptGenKey CryptExportKey CryptEncrypt CryptAcquireContextW SetServiceStatus CryptReleaseContext StartServiceCtrlDispatcherW CryptDestroyKey

shell32

SHGetSpecialFolderPathW ShellExecuteA

shlwapi

StrStrW

crypt32

CryptStringToBinaryA CryptImportPublicKeyInfoEx CryptDecodeObjectEx

mpr

WNetOpenEnumW WNetEnumResourceW WNetCloseEnum