Shasha ransomware (virus) - Recovery Instructions Included

What is Shasha ransomware?

Shasha ransomware is a dangerous computer infection that asks users to pay $50 for file decryption

Shasha ransomware ransom note

Shasha is a malicious virus that belongs to the ransomware category. This malware type can be particularly damaging, as its impact on personal files might be forever-lasting. It locks all documents, pictures, databases, videos, and other files located on a Windows system with the help of a sophisticated encryption algorithm, adding a .shasha extension in the process. Suchlike modified files can no longer be accessed or altered in any way – they would not open, regardless of which program is used for that.

While blank file icons and the inability to open them are one of the first signs of a ransomware infection, there is a lot going on in the background. Before locking data, the Shasha virus first shuts down various processes and imports its own files, infecting the Windows system. If connected to a network, it could potentially spread even further and encrypt files on every other computer connected to it. This is why it is important to disconnect your PC from the internet as soon as a malware infection is spotted.

After file encryption, the virus sends a request to a remote server to retrieve a unique user ID, which is (usually) later used by attackers to recognize each of the victims. The encryption key is then sent to cybercriminals' C&C^[1] server, which it remains; in order to recover data, users would need this key, although, evidently, the hackers are not willing to give it up for free.

As soon as malware is done with file encryption, it changes the desktop wallpaper, which portrays a skull in a black background. This is probably the first significant sign that users see right after the data locking process. Additionally, the READ_ME.txt file is placed on the desktop, where users can read the message left by the attackers.

In this file, victims are explained that their data is locked and they need a decryptor that only crooks can provide. In exchange for it, users are asked to pay $50 in Bitcoin into a provided Bitcoin address. There is no guarantee that a decryption key will be forwarded to you, so paying might be risky – you might get scammed and lose your money as well.

If you have been infected with ransomware, you should not panic and perform the removal and recovery process correctly. Below you will find all the details needed for that.

How does ransomware work?

Since the start of the pandemic, there has been an increase of new ransomware attacks overall – this is not surprising due to the fact that other malware families, such as Djvu, have reached immense success, with their authors earning millions from ransom payments. Attacks on corporations also increased drastically; it all points at ransomware being an extremely lucrative but illegal business.

Shasha is a relatively new strain that was first spotted in October 2021. It is yet unknown who is behind it; ransomware is commonly produced by already active actors, although new ones emerge as well, all while trying to earn a quick buck from innocent users. And, unfortunately, they are often successful.

When looking at the ransom note, we couldn't spot anything out of the ordinary. The message is not exceptional in any way, it just tells victims about what happened to their files and what they should do next:

All of your files have been encrypted!
Your computer was infected with a ransomware virus. Your files have been encrypted and you won't
be able to decrypt them without our help.What can I do to get my files back?You can buy our special
decryption software, this software will allow you to recover all of your data and remove the
ransomware from your computer.The price for the software is $50. Payment can be made in Bitcoin only.
How do I pay, where do I get Bitcoin?
Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search
yourself to find out how to buy Bitcoin.
Many of our customers have reported these sites to be fast and reliable:
Coinmama – hxxps://www.coinmama.com Bitpanda – hxxps://www.bitpanda.com

Payment informationAmount: 0,0012 BTC
Bitcoin Address: 17CqMQFeuB3NTzJ2X28tfRmWaPyPQgvoHV

In comparison to Tisc, Efdc, or similar threats, these perpetrators don't seem to be asking much. Although, $50 can be a large sum of money, depending on the victim's country of residence. Paying the attackers is not recommended by various law authorities and security experts. By doing so, victims only encourage crooks to infect more people and prove that the illegal business model works. Unfortunately, some users have little choice, as files are just way too important for them.

Once files are encrypted, they are stripped of their icons and can no longer be opened

It is very common for ransomware authors to ask for Bitcoin; in fact, 98% of payments are done in precisely this cryptocurrency.^[2] It grants anonymity to hackers and also makes the transactions instantaneous.

Since Shasha ransomware is a new strain, there is little proof that the group behind it even has a working decryption tool. Instead of paying, remove malware from your system and use alternative methods for data recovery.

Use anti-malware software to get rid of ransomware

In some cases, ransomware self-deletes after it finishes its task for data encryption. According to the ransom note, cybercriminals are promising to remove malware from the system as soon as the payment is made. It goes without saying that you should not rely on whatever crooks tell you in the note because it is not necessarily true. It likely means that this virus does not terminate and continues to run in the background.

Instead, you should perform Shasha virus removal yourself – use powerful SpyHunter 5Combo Cleaner or Malwarebytes anti-malware software. Malware might interfere with the operation of these tools, so you should access Safe Mode and run the scan from there in such a case:

Windows 7 / Vista / XP

1. Click Start > Shutdown > Restart > OK.
2. When your computer becomes active, start pressing the F8 button (if that does not work, try F2, F12, Del, etc. – it all depends on your motherboard model) multiple times until you see the Advanced Boot Options window.
3. Select Safe Mode with Networking from the list.

Windows 10 / Windows 8

1. Right-click on the Start button and select Settings.
   
2. Scroll down to pick Update & Security.
3. On the left side of the window, pick Recovery.
4. Now scroll down to find the Advanced Startup section.
5. Click Restart now.
6. Select Troubleshoot.
7. Go to Advanced options.
8. Select Startup Settings.
9. Click Restart.
10. Press 5 or click 5) Enable Safe Mode with Networking.

Repair damaged system files

Before you try file recovery, you should also take care of your system health. Once malware gains access to your PC, it alters various settings, imports its own files, and launches new processes. At some point during the infection, the virus might damage vital Windows components, making the system unstable. This is especially true for newer ransomware variants, as they are more likely to have bugs^[3] in the code.

Unfortunately, security software is unable to fix these damaged files. For this purpose, we highly recommend you use a dedicated repair application instead:

• Download FortectIntego
• Click on the ReimageRepair.exe
  
  
• If User Account Control (UAC) shows up, select Yes
• Press Install and wait till the program finishes the installation process
• The analysis of your machine will begin immediately
• Once complete, check the results – they will be listed in the Summary
• You can now click on each of the issues and fix them manually
• If you see many problems that you find difficult to fix, we recommend you purchase the license and fix them automatically.

By employing this tool, you would not have to worry about future computer issues, as most of them could be fixed quickly by performing a full system scan at any time. Most importantly, you could avoid the tedious process of Windows reinstallation in case things go very wrong due to one reason or another.

Methods to recover .Shasha files without paying

Most of the people who get infected with ransomware have never heard of it before, and the only thing they see is that they can't open any files. Due to this, there are many misconceptions about what file encryption is – some victims think that their files were permanently damaged or that they return back to normal after a full system scan with anti-malware is performed. None of these statements are true.

If ransomware works as intended, it won't corrupt your files but simply lock them under a unique key, accessible only to cybercriminals. That being said, some new ransomware strains are known to be buggy, hence it might corrupt data by accident. Also, antivirus software is ineffective when it comes to data recovery, as it is designed to remove malicious files and stop malware from running and performing its operations.

Paying criminals can be an option, but it's a risky one. As we already mentioned, security experts recommend avoiding it at all costs. Instead, there are several alternative methods you could try.

1. Recovery software

You won't know whether or not recovery software will work for the locked files – it depends on many aspects.

Warning! Before you proceed with this step, use a USB drive or another storage device to make a backup of the locked files. Otherwise, the data could be damaged permanently

• Download Data Recovery Pro.
• Double-click the installer to launch it.
  
• Follow on-screen instructions to install the software.
• As soon as you press Finish, you can use the app.
• Select Everything or pick individual folders where you want the files to be recovered from.
• Press Next.
• At the bottom, enable Deep scan and pick which Disks you want to be scanned.
• Press Scan and wait till it is complete.
• You can now pick which folders/files to recover – don't forget you also have the option to search by the file name!
• Press Recover to retrieve your files.

2. Decryption tools

Many high-profile ransomware strains work as intended, which means that their encryption is secure and can't be broken. However, Novice malware developers commonly many mistakes, which allows security researchers to bypass the encryption and create a free, working decryptor. This might take some time, however. Check the following links:

• No More Ransom Project
• Free Ransomware Decryptors by Kaspersky
• Free Ransomware Decryption Tools from Emsisoft
• Avast decryptors