{"id":32789,"date":"2020-01-15T17:21:46","date_gmt":"2020-01-15T17:21:46","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/30845\/Satan-Ransomware-Rebrands-As-5ss5c-Ransomware.html"},"modified":"2020-01-15T17:21:46","modified_gmt":"2020-01-15T17:21:46","slug":"satan-ransomware-rebrands-as-5ss5c-ransomware","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/satan-ransomware-rebrands-as-5ss5c-ransomware\/","title":{"rendered":"Satan Ransomware Rebrands As 5ss5c Ransomware"},"content":{"rendered":"

The cybercrime group that brought us Satan, DBGer and Lucky ransomware and perhaps Iron ransomware<\/a>, has now come up with a new version or rebranding named “5ss5c”.<\/p>\n

In a previous blog post, Satan ransomware adds EternalBlue exploit<\/a>, I described how the group behind Satan ransomware has been actively developing its ransomware, adding new functionalities (specifically then: EternalBlue) and techniques with each run. Then, it appeared the group halted operations on at least the ransomware front for several months.<\/p>\n

However, as it turns out, the group has been working on new ransomware – 5ss5c<\/strong> – since at least November 2019.<\/p>\n

The following tweet got my attention:<\/p>\n

\u2014 onion (@jishuzhain) January 12, 2020<\/a><\/p><\/blockquote>\n

After some quick checks, it appears this is a downloader for the 5ss5c ransomware, which is extremely reminiscent of how Satan ransomware operated:<\/p>\n\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Figure 1 – 5ss5c downloader<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

<\/span><\/span><\/p>\n

The malware will leverage certutil and even contains logging:<\/p>\n\n\n\n\n
<\/a><\/td>\n<\/tr>\n
Figure 2 – certutil logging<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

It will download and leverage:<\/p>\n