This ransomware strain is trying to disable Windows Defender and Malwarebytes

That is Clop CryptoMix - a type of ransom malicious code belonging to CryptoMix strain which has been raining all over the world in recent months. To successfully encrypt the victim's data, Clop CryptoMix is currently trying to disable Windows Defender as well as remove the standalone Anti-Ransomware programs of Microsoft Security Essentials and Malwarebytes.

Basically, Clop CryptoMix is a variant of CryptoMix Ransomware, uses the .Clop extension and owns a ransom note called CIopReadMe.txt (signature: "Dont Worry C | 0P"). You could call this ransom malicious code Clop.

Try to disable Windows Defender

According to analysis done by renowned security researcher Vitali Kremez, Clop has added the ability to silently execute a special technique, allowing it to disable many types of security software before code. Data of victims, including Windows Defender and some security software of Malwarebytes.

This is essentially a technique that helps combat file encryption detection behavior algorithms as well as blocking security software ransomware.

To disable Windows Defender, Clop will configure various Registry values to disable behavior monitoring, real-time protection, malicious code uploads to Microsoft, Tamper Protection, cloud security and detect anti-spyware software . of this program.

The good news is that if you have Tamper Protection turned on in Windows 10, these settings will be reset to their default settings and Windows Defender will still function normally without being disabled, and vice versa.

In addition to Windows Defender, Clop is also targeting older computers by uninstalling Microsoft Security Essentials. The fact that CryptoMix is run by admin privileges from the attackers, so it is possible to completely remove the software without any problems.

Try to uninstall Malwarebytes Anti-Ransomware

Security team MalwareHunterteam has discovered that besides Windows Defender, Clop is similarly targeting the standalone Malwarebytes Anti-Ransomware program.

When executed, the malicious code will attempt to disable Malwarebytes Anti-Ransomware programs with the following command:

 C: Program FilesMalwareBytesAnti-Ransomwareunins000.exe / verysilent / suppressmsgboxes / norestart

On the other hand, CryptoMix is usually installed via Remote Desktop or penetrated the network, so targeting products that old enterprise workstations may be using allows this ransomware software to self because it works without any barriers to encryption of the entire network.

Neither Microsoft nor Malwarebytes have commented on the findings.

Marvin Fry

Update 26 November 2019

You should read it

May be interested

How to Disable Microsoft Defender for a Specific Application in Windows
sometimes it can interfere with certain processes, such as installing third-party software, by falsely marking them as malware.
Warning: Ransomware is spreading through fake malicious Windows updates
named magniber, this dangerous ransomware strain has been around on the internet for a while, and ranks in the dangerous group with its diverse infectivity.
How to enable Controlled Folder Access anti-ransomware feature on Windows 10/11
controlled folder access is a feature of microsoft's windows security desktop antivirus application. it prevents ransomware by preventing modifications to files in protected folders.
Detection of a new ransomware strain targeting the Windows search engine
a ransomware attack begins when the victim receives an executable file containing malicious code via email.
RegretLocker: A new strain of ransomware that targets Windows virtual machines
regretlocker was first discovered in october, and is considered to be a formally simple ransomware strain.
What is Ransomware Task Force (RTF)?
ransomware has become one of the top security threats in the past three years. the first ransomware strain and one of the worst nightmares in the history of global cybersecurity - wannacry - was discovered in may 2017.
How to use Malwarebytes Anti-Malware to scan and remove malware
malwarebytes anti-malware is one of the leading antivirus and computer protection software available today. with the ability to detect and remove malware, trojans, ransomware, adware, and other security threats, malwarebytes helps keep your personal data safe.
How to turn off Windows Defender on the latest Windows 10 2024
turning off windows defender on windows 10 is a trick that users should do if they want to use other security software or simply want to turn it off temporarily to perform some special tasks such as installing software. for detailed steps to disable windows defender, readers can refer to the following instructions.
Detecting a new ransomware strain that specializes in stealing login information from the Chrome browser
a ransomware strain called qilin was recently discovered using a relatively sophisticated tactic, with high customization capabilities, to steal account login information stored in the google chrome browser. .
Kill viruses effectively with Malwarebytes Premium software
combining the preeminent features of the 3 tools for detecting and destroying malicious programs, malwarebytes premium has 4 times more productive productivity than the old version.