{
	"id": "533cf68b-3ee1-4694-bc27-b065c1f4f412",
	"created_at": "2026-04-06T00:09:09.745583Z",
	"updated_at": "2026-04-10T03:22:01.127236Z",
	"deleted_at": null,
	"sha1_hash": "2ab26b96a4e84b1d578d5c9d6ea16ca48c07b5d7",
	"title": "Released: Decryptor for Cl0p ransomware's Linux variant - Help Net Security",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 88253,
	"plain_text": "Released: Decryptor for Cl0p ransomware's Linux variant - Help\r\nNet Security\r\nBy Zeljka Zorz\r\nPublished: 2023-02-07 · Archived: 2026-04-05 16:36:13 UTC\r\nFlawed encryption logic used in Cl0p (Clop) ransomware’s Linux (ELF) variant has allowed SentinelOne\r\nresearchers to create and release a free decryptor.\r\n“The [Cl0p] Windows variant encrypts the generated RC4 key responsible for the file encryption using the\r\nasymmetric algorithm RSA and a public key. In the Linux variant, the generated RC4 key is encrypted with a RC4\r\n[hardcoded] ‘master-key’,” the researchers explained.\r\nThe differences between Windows and Linux variants\r\nThe Linux Cl0p variant is relatively new, and was first spotted by the researchers in late December 2022.\r\n“It appears to be in its initial development phases as some functionalities present in the Windows versions do not\r\ncurrently exist in this new Linux version,” they noted.\r\nhttps://www.helpnetsecurity.com/2023/02/07/cl0p-ransomware-decryptor-linux/\r\nPage 1 of 2\n\n“A reason for this could be that the threat actor has not needed to dedicate time and resources to improve\r\nobfuscation or evasiveness due to the fact that it is currently undetected by all 64 security engines on VirusTotal.”\r\nThe differences between the Windows and Linux variant are many. For example, the former avoids encrypting\r\nspecific folders, files and files with specific extenstions, and the latter does not. The former can be executed with\r\ndifferent parameters to guide which drives will be targeted for encryption, while the latter is focused on encrypting\r\njust the specified hardcoded folders. The former carries an encrypted ransom note that gets encrypted, but the\r\nformer stores the note as plain text.\r\nBut the most consequential difference – from the victims’ perspective, that is – is the flaw that made possible the\r\ncreation of the decryptor.\r\n“Over the last twelve months or so we have continued to observe the increased targeting of multiple platforms by\r\nindividual ransomware operators or variants,” the researchers noted.\r\n“While the Linux-flavored variation of Cl0p is, at this time, in its infancy, its development and the almost\r\nubiquitous use of Linux in servers and cloud workloads suggests that defenders should expect to see more Linux-targeted ransomware campaigns going forward.”\r\nIt is to be expected that Cl0p ransomware developers will fix the vulnerability soon. In the meantime, victims can\r\nuse the decryption tool and look into better protecting their systems against ransomware attacks in general.\r\nSource: https://www.helpnetsecurity.com/2023/02/07/cl0p-ransomware-decryptor-linux/\r\nhttps://www.helpnetsecurity.com/2023/02/07/cl0p-ransomware-decryptor-linux/\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"Malpedia"
	],
	"references": [
		"https://www.helpnetsecurity.com/2023/02/07/cl0p-ransomware-decryptor-linux/"
	],
	"report_names": [
		"cl0p-ransomware-decryptor-linux"
	],
	"threat_actors": [],
	"ts_created_at": 1775434149,
	"ts_updated_at": 1775791321,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/2ab26b96a4e84b1d578d5c9d6ea16ca48c07b5d7.pdf",
		"text": "https://archive.orkl.eu/2ab26b96a4e84b1d578d5c9d6ea16ca48c07b5d7.txt",
		"img": "https://archive.orkl.eu/2ab26b96a4e84b1d578d5c9d6ea16ca48c07b5d7.jpg"
	}
}