General
-
Target
https://github.com/kh4sh3i/Ransomware-Samples
-
Sample
241117-q88hqswjhl
Score
10/10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/kh4sh3i/Ransomware-Samples
Resource
win11-20241007-en
windows11-21h2-x64
24 signatures
300 seconds
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\!satana!.txt
Ransom Note
You had bad luck.There was crypting of all your files in a FS bootkit virus
<!SATANA!>
To decrypt you need send on this E-mail: [email protected]
your private code: 114F2C1C7F3289308101CECD6F2FDC44 and pay on
a Bitcoin Wallet: Xoq9wmiB1vbT7WAkGZWcgex544YGdC93Eb total 0,5 btc
After that during 1 - 2 days the software will be sent to you - decryptor -
and the necessary instructions. All changes in hardware configurations of
your computer can make the decryption of your files absolutely impossible!
Decryption of your files is possible only on your PC!
Recovery is possible during 7 days, after which the program - decryptor -
can not ask for the necessary signature from a public certificate server.
Please contact via e-mail, which you can find as yet in the form of a text
document in a folder with encrypted files, as well as in the name of all
encrypted files.If you do not appreciate your files we recommend you format
all your disks and reinstall the system. Read carefully this warning as it is
no longer able to see at startup of the computer. We remind once again- it is
all serious! Do not touch the configuration of your computer!
E-mail: [email protected] - this is our mail
CODE: 114F2C1C7F3289308101CECD6F2FDC44 this is code; you must send
BTC: Xoq9wmiB1vbT7WAkGZWcgex544YGdC93Eb here need to pay 0,5 bitcoins
How to pay on the Bitcoin wallet you can easily find on the Internet.
Enter your unlock code, obtained by E-mail here and press "ENTER" to
continue the normal download on your computer. Good luck! May God help you!
<!SATANA!>
Emails
Targets
-
-
Target
https://github.com/kh4sh3i/Ransomware-Samples
Score10/10-
Satana family
-
Executes dropped EXE
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1