satana | 6f7131cd04a865fca6b653914e82ed806ae2b47af926c056f8e66cc7e7d54557

General

Target
Ransomware.Satana.zip.zip
Size 57KB
Sample261028-3mysmahf79
SHA256 6f7131cd04a865fca6b653914e82ed806ae2b47af926c056f8e66cc7e7d54557
MD5 1a605fefb3df992e51054f4e017aaf42
SHA1 a24d335d4db4427fd765f6b8a0880808de60f9bd
SHA512 d6051dfa6dc02e9f04ada80f673ad85b52342f9dd46f1dfa3060981d25d248c01e7a19a20a955ccc6c6c0860a372edd395e817b0dfd4d4edcb58ca9f0d58bf93
SSDEEP 1536:QLBMjwR0bC5RfFl/jm0gIq/zn2M+5I2Xx6nIpyE6nRUiMG:sBMjE5RDhgIqV2XxxpN6nRBMG
TLSH
T13543016F10B0E773DD35F9CEC21BC272C4E77ED09D76B0984740249228296592D75EB8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!satana!.txt

Ransom Note

You had bad luck.There was crypting of all your files in a FS bootkit virus <!SATANA!> To decrypt you need send on this E-mail: [email protected] your private code: 663DDA59A614EFCE4207CE4586D610C7 and pay on a Bitcoin Wallet: XqgWm5YW5U7H1Zrr3fcrdTPDwE7DefDTxi total 0,5 btc After that during 1 - 2 days the software will be sent to you - decryptor - and the necessary instructions. All changes in hardware configurations of your computer can make the decryption of your files absolutely impossible! Decryption of your files is possible only on your PC! Recovery is possible during 7 days, after which the program - decryptor - can not ask for the necessary signature from a public certificate server. Please contact via e-mail, which you can find as yet in the form of a text document in a folder with encrypted files, as well as in the name of all encrypted files.If you do not appreciate your files we recommend you format all your disks and reinstall the system. Read carefully this warning as it is no longer able to see at startup of the computer. We remind once again- it is all serious! Do not touch the configuration of your computer! E-mail: [email protected] - this is our mail CODE: 663DDA59A614EFCE4207CE4586D610C7 this is code; you must send BTC: XqgWm5YW5U7H1Zrr3fcrdTPDwE7DefDTxi here need to pay 0,5 bitcoins How to pay on the Bitcoin wallet you can easily find on the Internet. Enter your unlock code, obtained by E-mail here and press "ENTER" to continue the normal download on your computer. Good luck! May God help you! <!SATANA!>

Emails

[email protected]

Targets

- Target
  unpacked.mem
- Size 72KB
- SHA256 b38b4c1dcf6d6ecd1bbfc236b43c37c18044c2f42f11e5088384f4bd0751929c
- MD5 108756f41d114eb93e136ba2feb838d0
- SHA1 8c6b51923ee7da2f4642c7717db95fbb77d96164
- SHA512 d13183e8ba4689475b0cb3f5cc7acbfba34a1ba661eb5988984647c2bd3e561cfa03f6267f60ae9fb2ca0783f26c105cdbcfc89def598c48968febef23c21aaa
- SSDEEP 768:F9NJK3qZRhxXHIQBsLL16BKc+bBQZ/UMc2:rXzXol6cc+lQZMMc2
- TLSH
  T124738D29ED458132EB7001F61DFA9F69AC1EA6B84F275CE362CDA8C12D290D3F970143
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

bootkit defense_evasion discovery satana persistence ransomware
- Family: Satana
  Ransomware family which also encrypts the system's Master Boot Record (MBR).
  ransomware satana
- Deletes itself
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
behavioral1