Updated PClock Ransomware Still Comes Up Short
Summary: Unit 42 Palo Alto Networks reports that an updated PClock ransomware variant, PClock2, appeared in August, replacing the original 2015 family's static-key XOR routine with RC4 encryption keyed from a SHA256 hash of collected system data and the target file path. The Visual Basic malware installs as winjab.exe, persists via a registry key, forwards Bitcoin payments to a hardcoded wallet through the blockchain.info API, and deletes shadow copies with a VBScript running vssadmin.
Why it matters: On a test sandbox PClock2 took upwards of 20 minutes to finish encrypting, against roughly 1-3 minutes for the latest CryptoWall, and it generated over 1,000 HTTP POST requests to its command-and-control server - a volume of beaconing and a window of time that detection has a real chance to catch.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026