Threat Analysis Unit (TAU) Threat Intelligence Notification: SatanCryptor Ransomware

In early January 2020, a new ransomware named ‘SatanCryptor’ was discovered. After it performs file encryption, it will drop a ransom note named “# SATAN CRYPTOR #.hta” and append ‘.satan’ as a file extension to the encrypted files. In addition, SatanCryptor will delete itself after the execution to hide its persistence.

Figure 1: Screenshot of the ransom note

Figure 2: Screenshot of the list of encrypted files by SatanCryptor and dropped ransom note.

This post serves to inform our customers about detection and protection capabilities within the Carbon Black suite of products against SatanCryptor Ransomware.

Behavioral Summary

The following are the display of process chart and event log by SatanCryptor from CB Threat Hunter.

Figure 3: Process chart of SatanCryptor (The cmd command was executed to delete the executable of SatanCryptor.)

Figure 4: Part of the event logs from SatanCryptor.

In addition, CB Defense will display the malware’s overall triggered TTPs.

To learn more about how to defend against this attack, click here.

Remediation:

MITRE ATT&CK TIDs

Indicators of Compromise (IOCs)