Researchers at SentinelOne SentinelLABS have identified the first Linux (ELF) variant of Cl0p ransomware — and found a critical encryption flaw that makes it possible to recover encrypted files without paying the ransom. SentinelLABS has released a free decryptor for the variant, observed targeting a Colombian university around December 24, 2022, with victim data leaked on Cl0p's onion site on January 5, 2023.
A Bespoke Linux Build With a Fatal Flaw
Rather than porting the Windows version directly, Cl0p's developers built a separate ELF payload — a decision that introduced significant feature gaps and, critically, a fundamental cryptographic error. The Windows variant uses a Mersenne Twister PRNG to generate a unique 117-byte RC4 key per file, encrypts that key with an RSA public key, and stores the RSA-encrypted key alongside the encrypted file. Victims who pay receive a decryptor that uses the RSA private key to recover the per-file RC4 key and decrypt the data.
The Linux variant abandons RSA entirely. Instead, it uses a hardcoded RC4 master key stored in the global variable szKeyKey to encrypt each file's randomly generated RC4 key — a symmetric operation that makes the encryption trivially reversible. The hardcoded master key found in the analyzed sample is:
Jfkdskfku2ir32y7432uroduw8y7318i9018urewfdsZ2Oaifwuieh~~cudsffdsd
Because the same key encrypts every per-file RC4 key, SentinelLABS was able to construct a decryption flow: retrieve the master key, read each $filename.C_I_0P key file, decrypt the per-file RC4 key using the master key, and use the recovered RC4 key to decrypt the original file.
Additional Implementation Flaws
A secondary flaw in the key file creation process writes 256 bytes to the .C_I_0P key file despite only 117 bytes of meaningful encrypted key data — leaking stack memory including pre-encryption file metadata such as exact file size, timestamp of last status change (the encryption time), file node ID, file descriptor, and function return addresses. This unintentional forensic disclosure provides incident responders with valuable pre-encryption state information recoverable directly from the key files.
Targeted Directories and Behavioral Differences
The ELF variant encrypts files in hardcoded directories including /opt, /home, /root, and Oracle database mount points /u01 through /u04 — a targeting pattern suggesting deliberate focus on enterprise Linux server environments hosting databases and business-critical applications. Key behavioral differences from the Windows variant include: no folder or extension exclusion list, no command-line parameter support, mmap64/munmap for all file I/O regardless of size, and the ransom note stored as plain text in .rodata rather than as an encrypted resource.
Despite being undetected by all 64 engines on VirusTotal at time of discovery, the ELF variant is detected by SentinelOne Singularity on both Linux and Windows. SentinelLABS expects future Linux versions to close feature gaps with the Windows variant and correct the encryption flaws identified in this analysis.