Procedure examples

Clop has been packed to help avoid detection.

Clop can enumerate all processes on the victim's machine.

Clop can use cmd.exe to help execute commands on the system.

Clop has searched folders and subfolders for files to encrypt.

Clop has used built-in API functions such as WNetOpenEnumW(), WNetEnumResourceW(), WNetCloseEnum(), GetProcAddress(), and VirtualAlloc().

Clop can make modifications to Registry keys.

Clop can enumerate network shares.

Clop has used a simple XOR operation to decrypt strings.

Clop can use msiexec.exe to disable security tools on the system.

Clop can encrypt files using AES, RSA, and RC4 and will add the ".clop" extension to encrypted files.

Clop can kill several processes and services related to backups and security solutions.

Clop can delete the shadow volumes with vssadmin Delete Shadows /all /quiet and can use bcdedit to disable recovery options.

Clop has used the sleep command to avoid sandbox detection.

Clop can search for processes with antivirus and antimalware product names.

Clop can use code signing to evade detection.

Clop has checked the keyboard language using the GetKeyboardLayout() function to avoid installation on Russian-language or other Commonwealth of Independent States-language machines; it will also check the GetTextCharset function.

Clop can uninstall or disable security products.