███████╗██╗ ██╗██╗██╗ ███╗ ███╗██╗ ██╗████████╗███████╗██╗ ██╗ ██╔════╝██║ ██║██║██║ ████╗ ████║██║ ██║╚══██╔══╝██╔════╝╚██╗██╔╝ █████╗ ██║ ██║██║██║ ██╔████╔██║██║ ██║ ██║ █████╗ ╚███╔╝ ██╔══╝ ╚██╗ ██╔╝██║██║ ██║╚██╔╝██║██║ ██║ ██║ ██╔══╝ ██╔██╗ ███████╗ ╚████╔╝ ██║███████╗ ██║ ╚═╝ ██║╚██████╔╝ ██║ ███████╗██╔╝ ██╗ ╚══════╝ ╚═══╝ ╚═╝╚══════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚══════╝╚═╝ ╚═╝

⚠

Satan

ransomware2 mutex signatures

[BASIC_INFORMATION]

FAMILY_NAME:

Satan

CATEGORY:

RANSOMWARE

DESCRIPTION:

Satan is a ransomware family that encrypts files and demands payment for decryption. It uses specific mutexes to ensure only one instance runs on the infected system and has been rebranded as 5ss5c in later variants.

TAGS:

file_encryptionransom_demandwindows

[MUTEX_SIGNATURES](2)

[MUTEX_01]

SSSS_Scan

ANALYST: @adhikara13 DATE: 2024-12-19

REFERENCES:

https://www.trendmicro.com/vinfo/fi/threat-encyclopedia/malware/ransom.win32.satana.a

https://bartblaze.blogspot.com/2020/01/satan-ransomware-rebrands-as-5ss5c.html

[MUTEX_02]

SATAN_CRYPT

ANALYST: @adhikara13 DATE: 2024-12-19

REFERENCES:

https://www.trendmicro.com/vinfo/fi/threat-encyclopedia/malware/ransom.win32.satana.a

[QUICK_ACTIONS]

[THREAT_INTELLIGENCE]

ATTRIBUTION:

⚠Unknown

FIRST_OBSERVED:

2017

[SIGMA_RULE]

[STATISTICS]

MUTEX_COUNT:2

THREAT_ACTORS:1

ALIASES:0

TAGS:3

CATEGORY:RANSOMWARE

Malware profile loaded successfully