Geek's Advice

CCPS ransomware aims to lock your personal files for a ransom

CCPS ransomware virus is a highly destructive file-encrypting virus that emerged from the STOP/DJVU ransomware family. Like other variants, this virus encrypts all files it comes across in any computer it infects and goes ahead to append .ccps extension to each file name. For example, a file called 1.jpg becomes 1.jpg.ccps after the ransomware attack. Also, while the attack is going on, ransom notes referred as _readme.txt would be released in every folder. The _readme.txt ransom notes contain information from those behind the attack, notifying the victim about what just occurred and why they should pay certain fees as ransom in exchange for CCPS decryption tool.

They will point out that CCPS ransomware virus has succeeded in encrypted their entire database, including important documents, pictures, and all other files using a very strong encryption key that can’t be breached. Therefore, the victim has no other option than to respond to them to discuss the payment options. The cybercriminals will equally drop two email addresses with which they expect the victim to contact them. The emails are support@sysmail.ch and helprestoremanager@airmail.cc.

They will further inform the victim about their decryption service prices and the conditions of payment attached to it. In order to influence the victim to pay ASAP, they will state that complying within a timeframe of 72 hours (3 days) would enable the victim to leverage a 50% ransom fee slash, which brings it down to $490. However, failure to pay within that period means they would have to pay the full amount which they put at $980.

But if the victim contacts them through the email they provided, one will be informed that payments can only be done using cryptocurrency. Therefore, they would have to purchase cryptocurrency that is worth the ransom fee and transfer same to a wallet address they would make available for the purpose. They make use of this medium of payment to avoid being tracked by law enforcement agents who may be on their trail. To assure the victim that they have what it takes to restore their files, they may even request for a small portion of the encrypted files to be sent to them for test decryption.

Whatever is the case, our in-house cybersecurity team of experts’ advice victims NEVER TO PAY RANSOM, and the same advice is advocated by the FBI in their guidelines about how to respond to ransom demands. The reason why we take this stand is because of the following factors:

• Ransom costs a huge amount of money yet there is no guarantee you will recover your encrypted files.
• Paying ransom encourages cybercriminals to continue constituting nuisance in their desperation to extort victims of ransomware.
• More funds at their disposal help them recruit more hands, resulting in more victims.
• It is illegal to pay a ransom.

Unfortunately, cybercriminals have continued to extort millions from their victims. Therefore, more effort is needed to reduce their menace to the barest minimum. Moreover, these sort of malicious virus are known to release other Trojans that steal information such as VIDAR and AZORULT on the already infected computer aimed at stealing vital details like software login credentials, banking details, passwords saved on the computer, cryptocurrency wallets, browsing history etc. Such sensitive details in the wrong hands would most likely result in other scams or blackmails.

Victims of this STOP/DJVU malware variant should remove CCPS ransomware as fast as possible to prevent further damage. To be able to remove it properly, it is recommended that you set up your computer on Safe Mode with Networking option before running a strong antivirus with proven efficacy on it.

There is a good number of genuine antivirus software out there and there are equally unreliable ones, so you should be careful when choosing. If you’re not sure about which antivirus to go for, then you can make use of INTEGO Antivirus recommended by our experts. It is also recommended to download RESTORO to help repair Windows OS files affected by the virus.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques used by cybercriminals

Downloading software contents from online malicious torrents platform is the most prolific way cybercriminals distribute CCPS virus and other variants of STOP/DJVU ransomware. They usually upload malware-carrying software contents such as fake key generators, “cracks”, pirated games and utility software etc. and when users download such contents on their computer system, they end up triggering ransomware attack. Information gathered from victims over the years has shown there are particular software names that were usually mentioned. The most popular ones are listed below:

• Tenorshare 4ukey;
• VMware Workstation;
• Adobe Photoshop;
• AutoCad;
• Opera browser;
• Corel Draw;
• Fifa 20;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• KMSPico (illegal Windows activation tool).

Users that often visit such dangerous online torrents platform are hereby advised to desist from such acts in order to avoid becoming a victim of ransomware. When you try to activate paid software, utilities or even game versions without going through the right channels and paying the necessary fee requested by the original content developers, you may end up becoming a prey to cybercriminals and it’s not worth the risk. Therefore, it is better to obtain your software needs legitimately by visiting the official pages or third party affiliates endorsed by the original content producers.

Another medium used by cybercriminals to distribute ransomware is through malicious email attachments. They compose genuine-looking messages that would be accompanied by certain types of documents that were crafted using formats like DOCX, PDF, and XLS. These particular ones are their favorites because they allow JavaScript and other macro functions that are required for payloads to be successfully uploaded and triggered in random computers.

Trying to differentiate whether a particular email is real or from cybercriminals can be quite difficult since they now try as much as possible to make them appear like the ones popular companies or acquaintances would send. They often impersonate brands like Amazon, UPS, eBay or FedEx etc. and would give them names that appear important like Invoice, Tracking Details, and Order Summary etc.

Alternatively, they may decide to make use of email spoofing techniques to hide the actual sender’s email address. In situations like this, it is best to apply caution and common sense; is such email expected or is there something fishy about it? If there is nothing out of place about the email, you may proceed to open it otherwise it should be discarded.

Furthermore, those that are already victim to any of the STOP/DJVU ransomware variants, including CCPS ransomware should not seek for help from any of the suspicious websites that often advertise dubious decryption solutions because they are mostly fake and intended to be used for scam purposes.

At the moment, only DiskTuna and Emsisoft have proven to have data decryption/repair solutions that actually works. Some cybercriminals spread other versions of ransomware disguised as fake STOP/DJVU decryptors and downloading such fake decryptors can lead to multiple file encryptions.

More information about the infection

If you want to understand how much your computer was affected during CCPS ransomware attack, then this section should come handy as it explains the technical aspect of it. First thing this ransomware does is to launch the build.exe or build2.exe executables as well as winupdate.exe (the prompt that opens fake Windows update display). The virus then makes a connection with https[:]//api.2ip.ua/geo.json before saving the response on geo.json file. The ransomware then commences information gathering about every detail concerning the computer such as geolocation related data, time zone, zip code, latitude and longitude while also creating another file for hardware details, software list, and active processes in information.txt.

Displayed in the screenshot below is an example of geo.json file.

Contents of information.txt file are shown below.

The next thing it does is to profile the geolocation of the computer to determine if it falls within any of their encryption-exempted countries, namely; Russia, Uzbekistan, Syria, Armenia, Tajikistan, Ukraine, Kazachstan, Kyrgyzstan and Belarus. If peradventure it shows positive to any of the aforementioned countries, it will abort its mission, but if otherwise, it will then move to the next stage by extracting online encryption key from their server and will merge it with the victim’s ID and then forwards them to bowsakkdestx.txt file. The ID will be saved to PersonalID.txt file separately. Examples of these files are shown in the screenshot below.

If for any reason the malware fails to extract any online encryption ID, it will resort to the use of offline encryption ID as a replacement. The striking difference between offline ID and online ID is that the former is uniform for all victims of the same ransomware variant while the latter is unique to every specific victim. It is advantageous for victims if offline ID was used because it will increase chances of decrypting their CCPS files unlike online ID. More details about this is provided below.

At this point, the ransomware will commence full data encryption procedure whereby all the folders will be scanned and encrypted with Salsa20 before using RSA-2048 to lock the encryption key. While this is ongoing, the files will be marked will be marked with additional extensions.

Shown below is a screenshot of _readme.txt ransom note the virus drops in every folder.

Afterwards, the virus now deletes the Volume Shadow Copies while making use of the Command Prompt task as shown here:

^{vssadmin.exe Delete Shadows /All /Quiet}

The virus then blacklists certain domains in other to prevent the victim from getting help online which prompts the DNS_PROBE_FINISHED_NXDOMAIN error message whenever they try to go to any of those sites.

Remove CCPS Ransomware and Recover Lost Files

Here are the steps to take following a ransomware attack as recommended by our team of experts:

• Remove CCPS virus as quickly as possible.
• Report to the relevant authorities within your locality.
• Use any available backup device to restore lost files.
• Change all passwords that were used on the compromised computer.
• Learn if/how files encrypted by STOP/DJVU ransomware variants can be repaired.
• Consider downloading RESTORO to identify and repair virus-altered Windows OS files.

Before we wrap up, always remember it is very important to complete CCPS ransomware virus removal with the use of INTEGO Antivirus or any other reputable antivirus with proven efficacy. However, the computer should be set up through the Safe Mode with Networking option to ensure optimal result.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.