Satan ransomware rebrands as 5ss5c

5ss5c is newly observed ransomware that has been attributed to the same threat actor that developed Satan.

5ss5c is distributed by a spreader module that uses both hardcoded credentials and the SMB EternalBlue exploit. It is accompanied by credential stealing modules including Mimikatz.

When executed, 5ss5c will stop database processes and then encrypt files with the following extensions: 7z, bak, cer, csv, db, dbf, dmp, docx, eps, ldf, mdb, mdf, myd, myi, ora, pdf, pem, pfx, ppt, pptx, psd, rar, rtf, sql, tar, txt, vdi, vmdk, vmx, xls, xlsx, zip.

The ransom note only contains instructions in Chinese, not Korean nor English like previous iterations.

Encrypted files are renamed with the email address 5ss5c@mail[.]ru at the beginning and the extension .5ss5c at the end. A ransom note in Chinese is then saved to the root directory of the C:\ drive.

Duncan

Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.