{"id":2274,"date":"2024-09-25T14:26:01","date_gmt":"2024-09-25T14:26:01","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=2274"},"modified":"2025-07-29T03:53:48","modified_gmt":"2025-07-29T03:53:48","slug":"cl0p-ransomware-gang-leaks-nsw-transport-data-on-the-dark-web","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/cl0p-ransomware-gang-leaks-nsw-transport-data-on-the-dark-web\/","title":{"rendered":"CL0P Ransomware Gang Leaks NSW Transport Data On The Dark Web"},"content":{"rendered":"\n
\"CL0P
CL0P Ransomware Gang Leaks NSW Transport data on the Deep and Dark Web<\/figcaption><\/figure>\n\n\n\n

In this article, LMNTRIX<\/a> Labs will focus on the ransomware group \u201cCl0p\u201d \u2013 an extortionist Ransomware group who were operating and targeting companies from 2019. The Cl0p ransomware group techniques and tactics resemblance with TA505<\/a> a financially motivated threat group active since 2014.<\/p>\n\n\n\n

In recent days, LMNTRIX Labs have observed an increased activity of the Cl0p ransomware gangs targeting multiple enterprises, companies across the globe. Following is their activity timeline from the last two years.  This particular group has been visibly active throughout COVID-19 spike phases and targeted pharmaceutical companies extensively. Interestingly, the Accellion<\/a> breach which was reported due to a FTA vulnerability exploitation was also linked to the Cl0p ransomware group.<\/p>\n\n\n\n

Activity Timeline<\/strong><\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Sample Analysis<\/strong><\/h2>\n\n\n\n

Following sample was recently used by the Clop Ransomware group in their latest campaign<\/p>\n\n\n\n

SHA256<\/strong>: 15f9ed36d9efc6e570b4f506791ce2c6a849853e2f6d587f30fb12d39dba2649<\/p>\n\n\n\n

Sample Name<\/strong>: Ul7Koup6DD.bin<\/p>\n\n\n\n

Process path<\/strong>: C:\\Users\\Xmp\\Desktop\\hfq3LofMt4.exe<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

Analysing the sample, we have seen the malicious binary is sharing the code among all the samples seen for the Cl0p ransomware sample. Around 480+ strings reuse by the sample has also been observed.<\/p>\n\n\n\n

Related Sample<\/strong><\/h2>\n\n\n\n
Sample Timeline<\/strong><\/td>SHA256<\/strong><\/td><\/tr>
Feb 2021<\/strong><\/td>09ab880f3021ac2d05e09bebd567ddf5f6f7cfb396573efd819a056931f3b391<\/td><\/tr>
Dec 2019<\/strong><\/td>cff60c9c30bf71112c79f788c4ccbd7151285d52be31c8e891b365d93a7e241d<\/td><\/tr>
Nov\/Dec 2020<\/strong><\/td>7c19c49836ed7dccd0ebcd5a5a56f6b6411ecc59fdc7fa31f0ee0f64eee7aa89<\/td><\/tr>
Dec 2020<\/strong><\/td>7c6e5cd61fafd38e420c2bd9e12ed1ec06e31dd5d20c081d214a96c16b1492c8<\/td><\/tr>
Jan 2021<\/strong><\/td>968307a367471e25bef58b0d4687ab4fdf34539bbfb603b5b19ae99d4d0c0340<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n
\n
\"\"<\/figure>\n<\/div>\n\n\n

The ransomware program is written in C ++ and developed in Visual Studio. So far observed Cl0p samples are for the x86 architecture. The size of the unpacked sample is between 100 and 200 KB. Cl0p renames the encrypted files and appends the file ending with (“. Cllp ” OR “. CI0p”.)<\/p>\n\n\n\n

MITRE MATRIX<\/strong><\/h2>\n\n\n\n

<\/strong>Attribution<\/strong><\/h2>\n\n\n\n

The modus operandi of the gang has been to use the double extortion technique. They use lateral movement technique to exfiltrate large amount of victim\u2019s data from their network and then finally launches the Ransomware. This is a full proof method, that even though the victims have a backup of their data, and refuse to pay the ransom, the Gang still threatens to leak the data stolen onto their dark Web leak site as shown below. The gang also uses a chat site to chat with their victims to fix the extortion amount.<\/p>\n\n\n

\n
\"\"<\/figure>\n<\/div>\n\n\n

NSW Transport\u2019s terabytes of data was leaked onto the Dark Web in a similar fashion, when it was dumped in 9 different parts. These include contract details, email communications, and much more. Here is the snapshot from the NSW Transport leak:<\/p>\n\n\n\n

Mitigation<\/strong><\/h2>\n\n\n\n

*****YARA RULE FOR CLOP RANSOMWARE************************<\/p>\n\n\n\n

rule win_clop_auto {<\/em><\/strong><\/p>\n\n\n\n

    meta:<\/em><\/strong><\/p>\n\n\n\n

        date = “2021-2-21”<\/em><\/strong><\/p>\n\n\n\n

        version = “1”<\/em><\/strong><\/p>\n\n\n\n

\/* DISCLAIMER<\/em><\/strong><\/p>\n\n\n\n

     * The strings used in this rule have been automatically selected from the<\/em><\/strong><\/p>\n\n\n\n

     * disassembly of memory dumps and unpacked files, using .<\/em><\/strong><\/p>\n\n\n\n

strings:<\/em><\/strong><\/p>\n\n\n\n

        $sequence_0 = { 68???????? 68???????? e8???????? 83c424 6aff }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 5, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   68????????           |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   68????????           |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   e8????????           |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   83c424               | add                 esp, 0x24<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6aff                 | push                -1<\/em><\/strong><\/p>\n\n\n\n

        $sequence_1 = { ffd0 c3 8bff 55 8bec 83ec1c 8d4de4 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 7, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ffd0                 | call                eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   c3                   | ret                <\/em><\/strong><\/p>\n\n\n\n

            \/\/   8bff                 | mov                 edi, edi<\/em><\/strong><\/p>\n\n\n\n

            \/\/   55                   | push                ebp<\/em><\/strong><\/p>\n\n\n\n

            \/\/   8bec                 | mov                 ebp, esp<\/em><\/strong><\/p>\n\n\n\n

            \/\/   83ec1c               | sub                 esp, 0x1c<\/em><\/strong><\/p>\n\n\n\n

            \/\/   8d4de4               | lea                 ecx, [ebp – 0x1c]<\/em><\/strong><\/p>\n\n\n\n

        $sequence_2 = { 6a04 6800300000 6887000000 6a00 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 4, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6a04                 | push                4<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6800300000           | push                0x3000<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6887000000           | push                0x87<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6a00                 | push                0<\/em><\/strong><\/p>\n\n\n\n

        $sequence_3 = { 8d85bcefffff 50 ff15???????? 68???????? }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 4, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   8d85bcefffff         | lea                 eax, [ebp – 0x1044]<\/em><\/strong><\/p>\n\n\n\n

            \/\/   50                   | push                eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   68????????           |                    <\/em><\/strong><\/p>\n\n\n\n

        $sequence_4 = { ff15???????? 68???????? 8d85dcf7ffff 50 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 4, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   68????????           |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   8d85dcf7ffff         | lea                 eax, [ebp – 0x824]<\/em><\/strong><\/p>\n\n\n\n

            \/\/   50                   | push                eax<\/em><\/strong><\/p>\n\n\n\n

        $sequence_5 = { 6a00 ff15???????? 68???????? 8bd8 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 4, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6a00                 | push                0<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   68????????           |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   8bd8                 | mov                 ebx, eax<\/em><\/strong><\/p>\n\n\n\n

        $sequence_6 = { e8???????? 83c408 6aff ff15???????? 33c0 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 5, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   e8????????           |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   83c408               | add                 esp, 8<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6aff                 | push                -1<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   33c0                 | xor                 eax, eax<\/em><\/strong><\/p>\n\n\n\n

        $sequence_7 = { 8d85c8efffff 50 6a08 6a01 ff15???????? 85c0 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 6, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   8d85c8efffff         | lea                 eax, [ebp – 0x1038]<\/em><\/strong><\/p>\n\n\n\n

            \/\/   50                   | push                eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6a08                 | push                8<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6a01                 | push                1<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   85c0                 | test                eax, eax<\/em><\/strong><\/p>\n\n\n\n

        $sequence_8 = { 83c40c 33f6 85ff 7428 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 4, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   83c40c               | add                 esp, 0xc<\/em><\/strong><\/p>\n\n\n\n

            \/\/   33f6                 | xor                 esi, esi<\/em><\/strong><\/p>\n\n\n\n

            \/\/   85ff                 | test                edi, edi<\/em><\/strong><\/p>\n\n\n\n

            \/\/   7428                 | je                  0x2a<\/em><\/strong><\/p>\n\n\n\n

        $sequence_9 = { 53 8bf8 ff15???????? 8bf0 56 6a40 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 6, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   53                   | push                ebx<\/em><\/strong><\/p>\n\n\n\n

            \/\/   8bf8                 | mov                 edi, eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   8bf0                 | mov                 esi, eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   56                   | push                esi<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6a40                 | push                0x40<\/em><\/strong><\/p>\n\n\n\n

        $sequence_10 = { 83c40c 6860070000 6a40 ff15???????? }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 4, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   83c40c               | add                 esp, 0xc<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6860070000           | push                0x760<\/em><\/strong><\/p>\n\n\n\n

            \/\/   6a40                 | push                0x40<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

        $sequence_11 = { 8bf0 56 53 ff15???????? 50 ff15???????? 56 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 7, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   8bf0                 | mov                 esi, eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   56                   | push                esi<\/em><\/strong><\/p>\n\n\n\n

            \/\/   53                   | push                ebx<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   50                   | push                eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   56                   | push                esi<\/em><\/strong><\/p>\n\n\n\n

        $sequence_12 = { 53 56 ff15???????? 56 ff15???????? 53 ff15???????? }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 7, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   53                   | push                ebx<\/em><\/strong><\/p>\n\n\n\n

            \/\/   56                   | push                esi<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   56                   | push                esi<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   53                   | push                ebx<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

        $sequence_13 = { 50 ff15???????? 56 53 8bf8 ff15???????? }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 6, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   50                   | push                eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   56                   | push                esi<\/em><\/strong><\/p>\n\n\n\n

            \/\/   53                   | push                ebx<\/em><\/strong><\/p>\n\n\n\n

            \/\/   8bf8                 | mov                 edi, eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ff15????????         |                    <\/em><\/strong><\/p>\n\n\n\n

        $sequence_14 = { 83c424 53 50 ffd6 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 4, score = 300<\/em><\/strong><\/p>\n\n\n\n

            \/\/   83c424               | add                 esp, 0x24<\/em><\/strong><\/p>\n\n\n\n

            \/\/   53                   | push                ebx<\/em><\/strong><\/p>\n\n\n\n

            \/\/   50                   | push                eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   ffd6                 | call                esi<\/em><\/strong><\/p>\n\n\n\n

        $sequence_15 = { 50 e8???????? 83c40c c785f0efffff00080000 8d85f0efffff c785ecefffff00000000 c785f4efffff00000000 }<\/em><\/strong><\/p>\n\n\n\n

            \/\/ n = 7, score = 200<\/em><\/strong><\/p>\n\n\n\n

            \/\/   50                   | push                eax<\/em><\/strong><\/p>\n\n\n\n

            \/\/   e8????????           |                    <\/em><\/strong><\/p>\n\n\n\n

            \/\/   83c40c               | add                 esp, 0xc<\/em><\/strong><\/p>\n\n\n\n

            \/\/   c785f0efffff00080000     | mov    dword ptr [ebp – 0x1010], 0x800<\/em><\/strong><\/p>\n\n\n\n

            \/\/   8d85f0efffff         | lea                 eax, [ebp – 0x1010]<\/em><\/strong><\/p>\n\n\n\n

            \/\/   c785ecefffff00000000     | mov    dword ptr [ebp – 0x1014], 0<\/em><\/strong><\/p>\n\n\n\n

            \/\/   c785f4efffff00000000     | mov    dword ptr [ebp – 0x100c], 0<\/em><\/strong><\/p>\n\n\n\n

    condition:<\/em><\/strong><\/p>\n\n\n\n

        7 of them and filesize < 630784<\/em><\/strong><\/p>\n\n\n\n

}<\/em><\/strong><\/p>\n\n\n\n

____________________________XXXXXXXXXXXXXXXXX_______________________________________<\/em><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

In this article, LMNTRIX Labs will focus on the ransomware group “Cl0p” – an extortionist Ransomware group who were operating and targeting companies from 2019. The Cl0p ransomware group techniques and tactics resemblance with TA505 a financially motivated threat group active since 2014. In recent days, LMNTRIX Labs have observed an increased activity of the […]<\/p>\n","protected":false},"author":1,"featured_media":2275,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-2274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=2274"}],"version-history":[{"count":3,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2274\/revisions"}],"predecessor-version":[{"id":4218,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/2274\/revisions\/4218"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/2275"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=2274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=2274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=2274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}