Clop Ransomware

The Clop Ransomware is a file-locking Trojan that uses encryption for keeping media such as documents from opening. Missing backups and Notepad ransoming messages are additional symptoms of infection, similar to other threats of its classification. Keep your backups on other devices for security against localized data attacks and allow your anti-malware tools to remove the Clop Ransomware at the first opportunity.

Trojans Clopping Their Way through South America

Brazil's history of victimization by attacks from highly-customized financial spyware and file-locking Trojans like the DESYNC Ransomware and the MBRCodes Ransomware continues proving itself the norm, rather than the exception, for that nation's PC owners. As of February, a new variant of a file-locking Trojan is entering the fray for undisclosed ransom demands. The Clop Ransomware is reminiscent of the other threats of its category externally but also has a sophisticated method of taking the victim's data hostage.

The Clop Ransomware isn't placeable in a family, for now, although its 32-bit Windows installer is detectable by most anti-malware products. Although its installation routine uses standard, Registry-based exploits and asymptomatic behavior based on concealing its processes in the background, malware experts do find two details worth noting. Both of these issues correspond to how it locks the user's data efficiently, as follows:

• The Clop Ransomware uses the RSA encryption for blocking the files, which it tags with '.Clop' extensions. RSA is one of the more secure possibilities for cryptography and could raise issues with 'unlocking' the content through third-party software.
• The Clop Ransomware also uses a much less discriminating method of blocking this data, such as documents, images or archives. Unlike some file-locker Trojans, that target specific directories like the user's Downloads or desktop, the Clop Ransomware is verifiable for encrypting most content on the C drive, excluding the Windows OS. Other drives also could be at risk.

Saving Your Files from Getting Clopped

The threat actors for the Clop Ransomware's campaign, which is in its distribution stage to the public, are using a barely-edited version of previous ransoming messages for demanding ransoms. These Notepad files ask for money without specifying the currency and have little information other than the e-mail addresses. Because the criminals can take their money without giving a decryptor back for recovering your files, you always should search for alternate recovery options, if any are possible.

The Clop Ransomware's infection strategies call for future investigations. However, malware experts find past trends from file-locker Trojans, usually, emphasize e-mail or brute-force-based infiltrations. Spam e-mails may disguise the threat's installer as a financial or news document, and brute-forcing is possible for most login combinations with weak, non-secure passwords and usernames. Both residential and government/business systems can benefit from the protection of anti-malware products for identifying and removing the Clop Ransomware on sight.

The Clop Ransomware is another addition to a pile of Windows-based threats that's countless, but the tweaks to its encryption tactics are noteworthy. Saving your file to an obscure location isn't always enough to keep it out of the sights of a file-locker Trojan like this one.