Check out our video library AppCheck defending against newest ransomware, automatic recovery and real-time backup.

Satan Ransomware (<Random Filename>.stn)

  • Distribution Method : Download the file via a link included in the email message
  • MD5 : e586cec5d18da7e2382b81e5d21374fd
  • Major Detection Name : Ransom.Satan (Malwarebytes), Trojan.Win32.Z.Satan.189335.A (ViRobot)
  • Encrypted File Pattern : <Random Filename>.stn
  • Malicious File Creation Location :
     - C:\Users\%UserName%\AppData\Local\Temp\tmp_<Random>.bat
     - C:\Users\%UserName%\AppData\Roaming\<Random>\<Random>.exe
  • Payment Instruction File : 0_HELP_DECRYPT_FILES.html
  • Major Characteristics :
     - DBGer Ransomware series
     - File encryption using explorer.exe (Windows Explorer) Clean file
     - Guide a payment instrucition in 23 languages including English and Korean.
     - Disable system restore (vssadmin.exe delete shadows /all /quiet)
     - Interrupt file recovery using "C:\Windows\System32\cipher.exe" /W:<Drive Letter>