Clop Ransomware Now Kills Windows 10 Apps and 3rd Party Tools

[LASER_oneXM]

Content source

https://www.bleepingcomputer.com/news/security/clop-ransomware-now-kills-windows-10-apps-and-3rd-party-tools/

The Clop Ransomware continues to evolve with a new and integrated process killer that targets some interesting processes belonging to Windows 10 apps, text editors, programming IDEs and languages, and office applications. When the Clop Ransomware started circulating in February 2019, it was just your normal garden variety CryptoMix ransomware variant with the same features we have been seeing in this family since 2017.

In March 2019, though, the Clop Ransomware suddenly changed and began disabling services for Microsoft Exchange, Microsoft SQL Server, MySQL, BackupExec, and other enterprise software. The ransom note had also changed to indicate that the attackers were targeting an entire network rather than individual PCs.

 

[Sampei Nihira]

.....In machines with Tamper Protection enabled in Windows 10, the registry values will be reset back to their default configuration, and Windows Defender will be enabled again......

Clop Ransomware attempts to disable Win Defender and Malwarebytes

Experts discovered a new malware dubbed Clop ransomware that attempts to remove Malwarebytes and other security products.

securityaffairs.co

.......The malware does not have support for Windows XP in its use with the crypto functions, because the CSP used in Windows XP has another name, but if run in another operating system starting with Windows Vista, it can change the name in the debugger to acquire the context later and will generate a RSA public blob......

Clop Ransomware | McAfee Blog

This new ransomware was discovered by Michael Gillespie on 8 February 2019 and it is still improving over time. This blog will explain the technical

www.mcafee.com

not to mention that various commands of the infection sequence are blocked in my OS.