Geek's Advice

SSOI ransomware aims to lock all of your data on a computer and then extort you

SSOI ransomware is a new data-encrypting computer virus originating from the STOP/DJVU malware group. Its aim is to lock all files on the target Windows system using sophisticated encryption algorithms so that the computer user could no longer open, view or edit them. During the attack, the virus appends each filename with .ssoi extension and drops _readme.txt note in every folder. To illustrate, a file originally named 1.jpg appears as 1.jpg.ssoi, document.docx appears as document.docx.ssoi after being encrypted. The ransom note left by the virus suggests that the only possible solution to recover files is purchasing SSOI file decryption tool from cybercriminals.

Going deeper into _readme.txt ransom note contents, we can see that the cybercriminals reassure the victim that all files on the computer system were encrypted with the strongest algorithm. To specify, the encryption type used in STOP/DJVU attacks is Salsa20 + RSA-2048. The note suggests there is no solution other than paying a ransom to criminals, or files will remain unreadable for good. They suggest contacting victims interested in paying the ransom via two provided emails – support@sysmail.ch and supportsys@airmail.cc.

On top of that, the ransom note suggests that the amount of money the victim needs to pay depends on how quickly the victim reaches out to the operators of this nascent malware. If this is done within 72 hours starting from the infection timestamp, the crooks promise a 50% discount on the initial price. This means that the criminals will accept $490 as a ransom, however, if the victim hesitates for any longer, the price will be set to $980. The criminals won’t accept any other transaction form other than one made using cryptocurrency (Bitcoin) for anonymity purposes.

In attempt to convince the victim to pay up sooner, they even promise test decryption service on one encrypted file that doesn’t contain any valuable data. The note suggests attaching it alongside victim’s Personal ID when sending an email to the attackers.

We do understand that encrypted data is extremely important to all victims, however, we must stress out that PAYING A RANSOM IS NOT A RECOMMENDED OPTION. Cybersecurity experts do not support paying ransoms, and the same mindset is backed up by the official FBI ransomware response recommendations. First of all, paying a ransom doesn’t guarantee data recovery in many cases, besides, sending money to cybercriminals simply helps them to push more malware, develop more sophisticated malware and attack more people. Finally, by paying, you will be identified as a victim who is willing to pay up and might be specifically targeted again.

Data encryption isn’t the only damage inflicted by this ransomware variant. STOP/DJVU variants like SSOI virus are known to travel alongside RedLine, Vidar or Azorult information-stealing Trojans. These Trojans are capable of extracting your browser-saved login credentials, banking details, in-app login details, browsing history and other sensitive data and transferring them to cybercriminals’ servers. As a consequence, you might start getting blackmailed for more money or experience account theft or even financial losses.

If you have recognized the malware that’s altered your files, we strongly recommend that you remove SSOI ransomware virus without a delay. The best approach to complex malware removal is booting your PC in Safe Mode with Networking and running a trustworthy antivirus solution from there. If you’re unsure which AV brand to use, we strongly recommend INTEGO Antivirus. For repairing virus-damaged Windows OS files, we recommend downloading RESTORO.

Ransomware Summary

REMOVE MALWARE & REPAIR VIRUS DAMAGE

Ransomware distribution techniques

Ransomware-type threats from STOP/DJVU cybercrime gang are known to be distributed via fake software cracks and other tools meant to activate premium software versions illegally. SSOI virus is no different and it preys for potential victims in various torrent listings as well as in rogue websites offering password-protected archives that are supposed to launch a setup for popular software activation. Victims infected by malware from this ransomware group claim to be infected from rogue downloads that promised activation of these popular programs:

• KMSPico (illegal Windows activation tool).
• Fifa 20;
• Tenorshare 4ukey;
• AutoCad;
• Opera browser;
• Corel Draw;
• Nero Burning ROM;
• Microsoft Visio PRO;
• VMware Workstation;
• Cubase;
• Adobe Illustrator;
• League of Legends;
• Internet Download Manager;
• Adobe Photoshop.

If you have the bad habit of searching for 100% working full versions of software online and try to bypass legitimate websites where you have to pay for the license key, you risk exposing your PC to severe threats. Most of these downloads are simply malware launchers that do not have a single file related to the software you’re looking to activate. Cybercriminals know that many users are trying to bypass license key fees, so they use popular software names as a clickbait so that the potential victims would download and run the malware themselves in hopes to install desired software for free.

We strongly advise you to support legitimate software developers. Downloading illegal and pirated software versions is a copyright infringement, not to mention the cybersecurity dangers behind this. Believe us when we say that legitimate software copies cost way less than tools required to repair malware-inflicted damage on your computer and your private data.

Another common way to distribute malware is closely tied to email spam. Scammers tend to send mass emails using publicly available (such as made available via data leaks) email listings and they often try to impersonate a well-known company or someone you know (such as your colleague or a boss). Such deceptive emails typically urge the user to open email attachments that are usually named as documents used in daily communications (Invoice, Waybill, Order Summary, Missing/Pending Payment, etc). To appear more trustworthy, they may even spoof their original email address. In order to avoid getting infected, we strongly recommend you to inspect the email you received and if you have the slightest suspicion about its origins, do not click on inserted URLs and do not open its attachments. Look out for unfamiliar greeting line and typo mistakes in the message body.

Finally, victims of this ransomware should be careful when searching for decryption tools online. At the moment, there are only two tools capable of decrypting/repairing STOP/DJVU-infected files (by Emsisoft and DiskTuna), and their functionality has certain limitations. Beware of fake STOP/DJVU decryption tools distributed online which hide malware inside of them. Moreover, watch out for scammers advertising fake “hacker” profiles on Instagram or WhatsApp that promise they can decrypt your files. All they can do is steal your money and vanish.

How this ransomware operates: a detailed overview

For those curious what SSOI ransomware virus does after breaking into the target system, we have provided a simplified overview of its modus operandi. The main ransomware executable is usually named by 4 random characters, for example, 5GB4.exe or 12J6.exe. The malware also downloads additional processes – build.exe and build2.exe from its server. In some cases, it may launch a fake Windows update screen (winupdate.exe) to trick the victim into thinking there are some operating system updates being downloaded and installed.

Before starting data encryption, this ransomware collects some information about the compromised computer system. First of all, it connects to https[:]//api.2ip.ua/geo.json which triggers a geo.json file download. This file contains geolocation-related data about the computer and describes PC’s IP address, country, city, zip code, timezone, longitude and latitude and more. You can see a couple of geo.json examples in the image down below.

The virus also creates a file named information.txt which has a list of PC’s hardware specs, installed software and active processes. The virus additionally takes a screenshot of desktop and sends collected data to its Command&Control (C&C) server. Shown below is a screenshot of information.txt.

Before encrypting the data, the virus performs a check to see if the files on the system can actually be encrypted. The thing is, operators of STOP/DJVU tend to avoid encrypting files in computers located in these countries: Ukraine, Russian Federation, Syria, Armenia, Tajikistan, Kazachstan, Kyrgyzstan, Belarus, and Uzbekistan. If any of the countries are detected as the compromised PC’s location, the ransomware stops itself. However, if that’s not the case, it proceeds and attempts to retrieve a unique encryption key and victim’s ID from the C&C server. The key and ID will be saved into file called bowsakkdestx.txt, while the ID will be saved into PersonalID.txt file. Both files are shown in the screenshow presented below.

An interesting observation about the SSOI ransomware functionality is that it has two encryption modes, often referred to as online or offline encryption. With online encryption type, the virus successfully generates unique encryption key and ID for the victim, which hardens the chances to recover encrypted data. However, in cases where the virus fails to fetch a unique encryption key from its server, it uses a hardcoded offline encryption key instead. Victims affected by offline encryption will typically notice t1 characters at the end of their PersonalID and this also increases the chances to restore files in the future. You can learn more about this in this guide explaining possibilities to decrypt/repair STOP/DJVU encrypted data.

After deciding on encryption type, the ransomware begins data encryption. It scans all computer folders and encrypts each file with Salsa20 algorithm, then additionally securing it with the RSA-2048 key. As mentioned previously, the ransomware marks affected files with additional extension to make locked data distinguishable. The screenshot below showcases how a folder affected by this virus looks like.

Shown below is the latest version of _readme.txt note.

Lastly, the ransomware modifies Windows HOSTS file by mapping a list of domains to localhost IP. This way, the virus blocks access to various cybersecurity blogs and sites publishing information about ransomware attacks and recommended response. If the victim attempts to open one of the blacklisted websites via web search results or directly, errors similar to DNS_PROBE_FINISHED_NXDOMAIN will appear in web browser.

Remove SSOI Ransomware Virus and Decrypt Your Files

The most important thing to do when your PC gets compromised by this malware is to remove SSOI ransomware virus remains and other malware it possibly dragged into your computer. Without a doubt, the best way to cleanse the computer system is to run an up-to-date antivirus solution, but we strongly recommend that you boot your PC in Safe Mode with Networking first. This helps to deactivate malicious processes which may attempt to interfere with security software. You can find a tutorial on how to do it below.

Our team trusts and recommends INTEGO Antivirus for malware removal. Another good tool when dealing with ransomware can be downloaded here – RESTORO. In our opinion, it is really helpful when it comes to repairing Windows OS files damaged by computer malware.

Other recommendations by our team of security experts include:

• Do not forget to report cybercrime incident to local law enforcement agency.
• Use data backups to recover as many files as possible.
• Learn possible ways STOP/DJVU-encrypted files could be repaired.
• Change all passwords used on the infected computer.

OUR GEEKS RECOMMEND

Our team recommends a two-step rescue plan to remove ransomware and other remaining malware from your computer, plus repair caused virus damage to the system:

STEP 1. REMOVE AUTOMATICALLY WITH ROBUST ANTIVIRUS

REMOVE & PROTECT WITH INTEGO

Get INTEGO ANTIVIRUS for Windows to remove ransomware, Trojans, adware and other spyware and malware variants and protect your PC and network drives 24/7.. This VB100-certified security software uses state-of-art technology to provide protection against ransomware, Zero-Day attacks and advanced threats, Intego Web Shield blocks dangerous websites, phishing attacks, malicious downloads and installation of potentially unwanted programs.

Use INTEGO Antivirus to remove detected threats from your computer.

Read full review here.

STEP 2. REPAIR VIRUS DAMAGE TO YOUR COMPUTER

DOWNLOAD RESTORO

RESTORO provides a free scan that helps to identify hardware, security and stability issues and presents a comprehensive report which can help you to locate and fix detected issues manually. It is a great PC repair software to use after you remove malware with professional antivirus. The full version of software will fix detected issues and repair virus damage caused to your Windows OS files automatically.

RESTORO uses AVIRA scanning engine to detect existing spyware and malware. If any are found, the software will eliminate them.

Read full review here.

GeeksAdvice.com editors select recommended products based on their effectiveness. We may earn a commission from affiliate links, at no additional cost to you. Learn more.

Norbert Webb

Norbert Webb is the head of Geek’s Advice team. He is the chief editor of the website who controls the quality of content published. The man also loves reading cybersecurity news, testing new software and sharing his insights on them. Norbert says that following his passion for information technology was one of the best decisions he has ever made. “I don’t feel like working while I’m doing something I love.” However, the geek has other interests, such as snowboarding and traveling.