5ss5c ransomware

5ss5c ransomware is file encrypting malware that primary targets Chinese users via EternalBlue vulnerability

5ss5c ransomware is a file locking malware that is usually spread via EternalBlue vulnerability

5ss5c ransomware is crypto-malware that was first spotted in the wild by security researcher @jishuzhain on January 12, 2020. Initially, the sample tracked by experts was labeled as “unknown,” although looking further, it became clear that the virus derived from a relatively old family that uses RaaS (ransomware-as-a-service)^[1] scheme – Satan/DBGer ransomware. As it turns out, malware authors have been working on this new project since at least November 2019, and it is still in an active development stage. Upon infiltration, the downloader will download three modules, which include Mimikatz open-source software, a password stealer, EternalBlue exploit (it was patched by Microsoft back in March 2017)^[2], and the main 5ss5c ransomware payload.^[3]

5ss5c virus uses the AES encryption algorithm to encrypt only compressed files located on the system, unlike most other ransomware that targets all personal files, it focuses on encrypting only particular 32 file types – mostly archives, documents, and databases. Due to this, the danger level of malware is slightly diminished, although it can still result in major losses. _如何 解密 我 的 文件_.txt ransom note is also dropped which is written in Chinese and demands 1 Bitcoin for an allegedly working 5ss5c ransomware decryptor. For negotiation purposes, hackers provide [email protected] email.

While the malware does not encrypt all personal files, there are no known decryption tools currently available. Therefore, it is best to retrieve the lost data via backups, and then proceed with 5ss5c ransomware removal. For that, users should employ anti-malware software that recognizes the malicious program as follows:^[4]

• Trojan.DownLoader32.46808
• Trojan:Win32/Wacatac.B!ml
• Mal/Generic-S
• Win32/Filecoder.NZY
• Gen:Variant.Ulise.85367
• Win32:Trojan-gen
• Artemis!853358339279, etc.

Once the infection process of 5ss5c virus is triggered, it downloads the main malware executable cpt.dat, which is then placed into %Temp% folder, which loads and inserts multiple of other files throughout the system. Additionally, malware modifies Windows registry at \SOFTWARE\Microsoft\Windows\CurrentVersion\Run in order to be launched with every Windows reboot. Just as its predecessors, 5ss5c ransomware will terminate all services and processes related to databases.

5ss5c ransomware file encryption process usually lasts just a moment, although the length of the process may increase depending on the number of files present on the machine, as well as its connected networks. However, it will also exclude certain files via a predetermined list. Malware will encrypt the following file types:

7z, bak, cer, csv, db, dbf, dmp, docx, eps, ldf, mdb, mdf, myd, myi, ora, pdf, pem, pfx, ppt, pptx, psd, rar, rtf, sql, tar, txt, vdi, vmdk, vmx, xls, xlsx, zip

5ss5c ransomware is a type of virus that stems from Satan/DBGer ransomware family

Most ransomware viruses target all personal files on the host system to result in maximum losses and the higher need of victims paying the ransom. However, 5ss5c ransomware developers did not go for files that most regular users find the most important, such as pictures or videos – which suggests that malware developers are rather focusing on infecting companies that use databases and VMware-related extensions.

The affected files not only receive a .5ss5c extension but are also modified in other ways – an example of the encrypted file includes:

[[email protected]]data.zip.JAVRIXREHPPDEX8GL1U94XRS04TVJ59C7LT3E2MY.5ss5c

After file encryption is complete, 5ss5c ransomware will contact a Command & Control server, and also use hardcoded credentials downloaded previously to connect to an SQL database. Additionally, Mimikatz and a password/credential stealing module provide additional functionality to malicious actors, although it proves to be more devastating for the infected hosts.

To victims that users are aware of what happened to some data on their systems, a ransom note titled  _如何 解密 我 的 文件_.txt is dropped into C: drive, which translates to “How to decrypt my files_.txt” from Chinese. The contents of the message are as follows [translated]:

Some files have been encrypted
If you want to retrieve the encrypted file, send (1) Bitcoin to my wallet
If the payment is not completed within 48 hours from the start of encryption, the amount of decryption will double.
If you have other questions, you can contact me by email
Your decryption credentials are:

Email: [[email protected]]

As evident, crooks claim that the ransom size increases to 2 BTC after 48 hours of the initial infection. However, we strongly advise against contacting crooks and paying for the 5ss5c ransomware decryptor, as a chance of getting scammed remains. In other words, you might lose not only your files but also money that hackers get to keep.

Instead, you should backup all the locked files, remove 5ss5c ransomware, and then use alternative methods for data recovery if backups are not available. Note that you will have to access Safe Mode to get rid of the malware. In case your Windows machine struggles after ransomware termination, we suggest scanning it with Reimage Reimage Cleaner in order to fix virus damage and restore normal system functions.

EternaBlue flaw still remains an excellent choice to malware authors

Security researchers determined that 5ss5c ransomware is spread via the NSA’s EternalBlue vulnerability (also known by a CVE code CVE-2017-0144)^[5] which exploits Microsoft’s Server Message Block (SMB) protocol. Once NSA found out that the vulnerability has been leaked by Shadow Brokers, it had no coice but to inform Microsoft about it, and the company patched the flaw immediately. Despite that, many systems remained outdated and vulnerable, which resulted in the notorious WannaCry outbreak when 200,000 computers belonging to regular users and government institutions/organizations were compromised and data inside locked. The same flaw was later used to proliferate NotPetya ransomware, which resulted in millions of dollars of damages worldwide.

Despite that, there are numerous machines that are still not patched for the EternealBlue due to various factors, which makes the flaw a valid attack vector. It is worth noting that there are countless vulnerabilities that are constantly being exploited by malicious actors, and most of them can be mitigated with a timely application of security updates.

5ss5c ransomware runs a background task and modifies Windows registry to ensure smooth operation and data encryption process

Nevertheless, it does not mean that threat actors behind 5ss5c ransomware cannot use other methods for malware delivery – so industry experts always advise use comprehensive security measures, such as employing high-end anti-malware software, using strong passwords/password managers, adequately protecting Remote Desktop connections, enabling Firewall, implementing ad-blockers, never downloading pirated/cracked software,^[6] and, most importantly, backing up all the important data on external or virtual storage.

Remove 5ss5c ransomware from your system and patch software vulnerabilities

Quite often, ransomware victims are completely lost on what to do after the infection, as they most likely never heard about file locking malware, or the understanding is very much vague. 2-spyware exists in order to guide users with the help of 5ss5c ransomware removal instructions, as well as further actions after the infection is terminated.

Therefore, if you found your data encrypted by 5ss5c virus, do not panic, and proceed with the following:

1. Ensure that you have access to this article, as well as the instructions listed below via a different device.
2. Use a USB flash, external HDD, DVD, or any other external device to copy the encrypted files (you can also use cloud-based services like Google Drive) – in case this is not done, all encrypted files might get corrupted as soon as you remove 5ss5c ransomware.
3. Reboot your computer in Safe Mode with Networking, as explained in the instructions below.
4. Download and install powerful anti-malware software from the official vendor website or use a built-in Microsoft Defender, and perform a full system scan.
5. Reboot to normal mode, connect to your backups and copy the data over (if no backups are available – check the recovery section below).
6. Patch your system with the latest security updates by right-clicking on Start and going to Settings > Update & Security > Check for updates. If you are using Windows 7, go to Start > Control Panel > System and Security > Change settings, under Important Updates pick the Install updates automatically (recommended) option.