███████╗██╗ ██╗██╗██╗ ███╗ ███╗██╗ ██╗████████╗███████╗██╗ ██╗ ██╔════╝██║ ██║██║██║ ████╗ ████║██║ ██║╚══██╔══╝██╔════╝╚██╗██╔╝ █████╗ ██║ ██║██║██║ ██╔████╔██║██║ ██║ ██║ █████╗ ╚███╔╝ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██╔██╗ ███████╗ ╚████╔╝ ██║███████╗ ██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗██╔╝ ██╗ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝

⚠

Cl0p

ransomware4 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

Cl0p

CATEGORY:

RANSOMWARE

DESCRIPTION:

Cl0p is a ransomware that has been active since 2019, operating as a Ransomware-as-a-Service (RaaS). It targets both Windows and Linux systems and is associated with the Russian-speaking cybercriminal group TA505.

ALIASES:

TA505FIN11

TAGS:

raaswindowslinuxdata_exfiltration

[MUTEX_SIGNATURES](4)

[MUTEX_01]

')(%QU#jimf0932ijrkpo32jr3lfwe

ANALYST: @adhikara13 DATE: 2025-07-16

REFERENCES:

https://cyble.com/blog/cl0p-ransomware-active-threat-plaguing-businesses-worldwide/

[MUTEX_02]

LifeBeHappy#-#-#666^_-

ANALYST: @adhikara13 DATE: 2024-07-19

REFERENCES:

https://www.otorio.com/blog/ransomware-targeting-industry-4-0/

[MUTEX_03]

CLOP#666

ANALYST: @adhikara13 DATE: 2024-07-19

REFERENCES:

https://id-ransomware.blogspot.com/2019/02/clop-ransomware.html

[MUTEX_04]

^_-HappyLife^_-

ANALYST: @adhikara13 DATE: 2024-07-19

REFERENCES:

https://id-ransomware.blogspot.com/2019/02/clop-ransomware.html

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠TA505

FIRST_OBSERVED:

2019

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:4

THREAT_ACTORS:1

ALIASES:2

TAGS:4

CATEGORY:RANSOMWARE

Malware profile loaded successfully