Overview

overview

10

Static

static

10

Cl0pRansomware.zip

windows7-x64

1

Cl0pRansomware.zip

windows10-2004-x64

1

Resubmissions

29/03/2025, 11:32

250329-nnrclssvdv 10

29/03/2025, 10:50

250329-mxc1xa1zex 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Cl0pRansomware.7z

  • Size

    5.2MB

  • MD5

    8bdbdf89f41e42e658a4c849aaa2f3b0

  • SHA1

    23614a30b1216592e26aeeb8b171454788e07567

  • SHA256

    3c40ecf9dbc3d4ca1e3afa06cd9a9cfd22041cca117a4d767afc03dececc59a0

  • SHA512

    c88a5d12f7856df4dd7a7cd171f966e49b388217a91b7beb29f7f6403cab1fe9a72efbeef579e6e94f164d4cc2d66f28d2d848b10bf447b85d2d6d0b89db4324

  • SSDEEP

    98304:VvdpQqz2yi2bDNdeWH4Gny4PfQOOv5d6hYqOFcWgP64tdcYBu/Q5UDyA1dvj6ugB:Vv7Q824PNdd5XHub/GWotSYu/OA1dv2t

Score
10/10
clop

Malware Config

Extracted

Family

clop

Ransom Note
___ Universidad de La Salle ___ === DO NOT ATTEMPT TO RESTORE OR MOVE THE FILES YOURSELF. THIS MAY DESTROY THEM === Here are some of the files we downloaded from your network: \\172.19.20.216\C$\Users\ruthrodriguezez \\172.19.0.25\Secretaria General Docs \\172.19.15.59\C$\Users\sarangel If you refuse to cooperate, all data will be published for free download on our portal: http://santat7kpllt6iyvqbr7q4amdv6dzrh6paatvyrzl7ry3zm72zigf4ad.onion/ -> TOR browser CONTACT US BY EMAIL-> [email protected] or [email protected] OR WRITE TO THE CHAT AT-> http://6v4q5w7di74grj2vtmikzgx2tnq5eagyg2cubpcnqrvvee2ijpmprzqd.onion/remote0/93868e77-1331-411a-9643-dc9ad26a5095?secret=lasalle (use TOR browser)

Signatures

  • Clop family
    clop
  • Unsigned PE 3 IoCs

    Checks for missing Authenticode signature.

Files

  • Cl0pRansomware.7z
    .zip
  • 46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed.7z
    .7z

    Password: infected

  • 46cd508b7e77bb2c1d47f7fef0042a13c516f8163f9373ef9dfac180131c65ed
    .exe windows:6 windows x86 arch:x86

    d8b6baf12a07141de229c7d33c80f943


    Headers

    Imports

    Sections

  • c793a9225d799150538f058c886e2806083f6bc33813a3bd8231ab2775b7ec2f.7z
    .7z

    Password: infected

  • c793a9225d799150538f058c886e2806083f6bc33813a3bd8231ab2775b7ec2f
    .exe windows:6 windows x86 arch:x86

    dbb863249b9b19b41bddfe6e27b3cdcf


    Headers

    Imports

    Sections

  • dd2f458a29b666bbfe5a5dbf6a36c906d0140e0ae15b599e8b4da1863e7e41ff.7z
    .7z

    Password: infected

  • dd2f458a29b666bbfe5a5dbf6a36c906d0140e0ae15b599e8b4da1863e7e41ff
    .exe windows:6 windows x86 arch:x86

    b1ee5d11ebf0f5a83cd3df3f1fb65ee0


    Headers

    Imports

    Sections