찾아줄게요

CLOP 파일은 무엇입니까?

• 안녕하세요. 제 컴퓨터에서 CLOP라는 파일을 찾았는데 이것이 무엇인지 잘 모르겠습니다. 알려주시면 감사하겠습니다.

• CLOP 파일은 Cryptomix Clop Ransomware 입니다. Cryptomix에서 배포한 파일인 것으로 보입니다. 2019-03-16 18:39:13에 처음으로 보고되었으며 2019-03-16 18:51:30에 마지막으로 보고되었습니다.

• Cryptomix Clop 프로그램을 다운로드하여 CLOP 파일을 열 수 있습니다.

• Cryptomix 랜섬웨어 계열 변종.
  
  
  
  ## 관련 해시
  
  - d0cde86d47219e9c56b717f55dcdb01b0566344c13aa671613598cab427345b9
  
  - 2ceeedd2f389c6118b4e0a02a535ebb142d81d35f38cab9a3099b915b5c274cb
  
  - a867deb1578088d066941c40e598e4523ab5fd6c3327d3afb951073bee59fb02

• CIopReadMe (TXT)
  
  
  
  [email protected]
  
  [email protected]
  
  [email protected]
  
  
  
  -----BEGIN PUBLIC KEY-----
  
  MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC01RzGfT2wX535F129PXlD5Z1n 2O8qkkrmrg/vADi

• 연관 링크 #1: https://sensorstechforum.com/remove-clop-ransomware/

• 연관 링크 #2: https://www.bleepingcomputer.com/news/security/cryptomix-clop-ransomware-says-its-targeting-networks-not-computers/

• [2021-05-29 00:13:19] @moshsrv #Nobelium #Win32/NativeZone.C!dha sha256:2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252 https://www.virustotal.com/gui/file/2523f94bd4fba4af76f4411fe61084a7e7d80dec163c9ccba9226c80b8b31252/details https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name= Trojan:Win32/NativeZone.C!dha&threatId= -2147185566 https://twitter.com/moshsrv/status/1398326529881411585/photo/1

• [2020-11-23 17:20:04] @malwaretracekr #Ransomware #랜섬웨어 #이랜드 #ELand #Clop File : SysvolYSysZLogonQ.exe - Valid Signature Change Extension : <Encrypted File>.<Original FileName>.Cllp Ransom Note : README_README.txt https://www.virustotal.com/gui/file/3d94c4a92382c5c45062d8ea0517be4011be8ba42e9c9a614a99327d0ebdf05b/details @kisa118 @ZeroCERT @malwrhunterteam @SEO20293818 @BongphilKim https://twitter.com/malwaretracekr/status/1330803292318797827/photo/1

• [2020-11-12 15:36:05] @WikiJM @blueteamblog https://www.hybrid-analysis.com/ https://www.abuseipdb.com/ https://packettotal.com/ https://www.virusradar.com/en/threat_encyclopaedia http://www.useragentstring.com/ http://nsrl.hashsets.com/national_software_reference_library1_search.php

• [2020-03-11 10:55:26] @blackorbird #SMB #Worm?? The vulnerability is due to an error when the vulnerable software handles a maliciously crafted compressed data packet. Attacker can remote exploit(CVE-2020-0796) this to execute arbitrary code. ref: https://fortiguard.com/encyclopedia/ips/48773 … pdate or disable: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/adv200005 … pic.twitter.com/PoDzTN4bau

• [2020-02-15 02:17:38] @AltShiftPrtScn #Cobalt C2 used in #CLOP ransomware attack: https://www.shodan.io/host/91.214.124.25 …

• [2020-02-06 19:16:52] @VK_Intel 2020-02-06: #TA505 Injector #Loader 'wsus.exe' #TinyMet #Payload v0.2 'tinymet.exe' h/t @malwrhunterteam TinyMet as Precursor for TA505 Post-Exploitation Operation to #Clop #Ransomware MD5: b7fd25034019bc0b09242047d2c1d62a pic.twitter.com/YuhPSdLKas

• [2020-01-31 07:43:56] @redrummy Fresh spam from Russia with love - Trojan:Script/Oneeva.A!ml I'm not sure what VirusTotal is doing tho. because Windows Defender absolutely does catch it. ClamAV. however. continues to be useless. #Malware https://www.virustotal.com/gui/file/e77507069cf5a05ab8e11e2929cf33f02e05ed3c1be03284085d152bd7971f7c/detection … https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?name= Trojan%3aScript%2fOneeva.A!ml&threatid= 2147729349 …

• 보이스피싱, 불법촬영물, 랜섬웨어, 사이버 안보위협 등에 관련된 사안의 경우 다음과 같은 기관 및 단체의 도움을 받을 수 있습니다. 노모어랜섬(No More Ransom) 경찰청 사이버범죄 신고시스템 국가정보원 민원센터