Overview

overview

9

Static

static

satan_1.0.0.6.vir.exe

windows7_x64

9

satan_1.0.0.6.vir.exe

windows10_x64

9

Sharing

Copy URL Twitter E-mail

General

  • Target
    satan_1.0.0.6.vir
  • Size 186KB
  • Sample200719-qqms7j6ddx
  • SHA256 84dd7afbfc63272eea2c55b6d079ef1897971516e3a7359aa932fec10ea6d4b6
  • MD5 SHA1 SHA512
Score
9/10
evasionpersistenceransomwaretrojan

Malware Config

Targets

    • Target
      satan_1.0.0.6.vir
    • Size 186KB
    • SHA256 84dd7afbfc63272eea2c55b6d079ef1897971516e3a7359aa932fec10ea6d4b6
    • MD5 SHA1 SHA512
    Score
    9/10
    evasionransomwarepersistencetrojan

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomware

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Checks whether UAC is enabled

      evasiontrojan

    • Modifies service

      persistence

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks