Satan – A computer hijacker virus

Satan, a virus that was discovered in 2016, this virus does two things: it encrypts files and corrupts the main boot record or MBR, thus blocking the Windows startup process. Like the well-known Petya. In some respects, Satan behaves similarly, such as entering his own code into the MBR. Still, while Petya encrypts the master file table, Satana encrypts the MBR. To encrypt the files on the PC, but the difference is that Petya to encrypt the files on the PC, it needs the help of its fellow Trojan, which Satan does not, since it performs both tasks by itself.

The problem is that over time, several variants of this have come to light, which even attack financial sector organizations with crypto miners and ransomware.

Variants of Satan

The first variant of this malware, which the security solutions provider NSFOCUS detected, is targeted at Linux and Windows systems and spreads by exploiting various application vulnerabilities. After establishing a foothold in a system, the virus simply spreads further without causing further damage.

The second variant of Satan that is also capable of spreading through Windows and Linux platforms. But, unlike the first sample, this variant is a ransomware that encrypts local files and appends the word (.lucky) to the file names of affected assets. It also installs the XMRig Monero miner on the infected machines.

Finally, the discovered version 4.2 of the Satan ransomware remains, this time being oriented to Windows servers. When Satan successfully hacks the server, it uses it as a zombie server and then scans and tries to invade other computers with vulnerabilities from the network. Furthermore, this new version of also uses two new system vulnerabilities to spread, so that users cannot avoid it. After the attack is launched, if it is successful, the file is encrypted and suffixed with the word (sicck). Of course criminals impose extortion in bitcoins to recover certain information.

See also:
Jokeroo – The ransomware that kidnaps
Ransomware – Cyber attacks to make you pay

---