A new Ransomware as a Service, or RaaS, called Satan has been discovered by security researcher Xylitol. This service allows any wannabe criminal to register an account and create their very own customized version of the Satan Ransomware.
Once the ransomware is created, it is then up to the criminal to determine how they will distribute the ransomware, while the RaaS will handle the ransom payments and adding new features. For this service, the RaaS developer takes a 30% cut of any payments that are made by victims. According to the advertisement for the Satan RaaS, the developer will reduce their cut depending on the volume of payments received by an affiliate.
The Satan RaaS
When a person first goes to the Satan RaaS they will be greeted with a home page that describes what the service is and how a criminal can make money with it.
The Droppers page, shown below, provides code that assists the affiliate in creating malicious Microsoft Word macros or CHM installers. These can then be used by the affiliate to distribute the ransomware via SPAM or other means.
This the first time I have seen a public RaaS like this offer tips and help to the affiliates when it comes to distribution methods. This type of hand holding could allow a curious affiliate to become an active one.
The Translate page allows affiliates to expand the languages used by Satan for the ransom notes.
The Account page is where the affiliate can see the amount of people infected, the amount paid, and other information.
Finally there is a Notices page, which will be used to display messages from the RaaS developer, and a Messages page that can be used for “customer service” requests.
As for the Satan Ransomware Itself…
When the Satan Ransomware is installed it will check to see if it is running under a virtual machine, and if it is, will terminate. Once executed it will inject itself into TaskHost.exe and begin to encrypt the data on the computer. It is currently unknown what encryption algorithm Satan uses, but it will target files with the following extensions:
When it has encrypted a file, it will scramble its name and append the .stn extension to the file. For example, test.jpg may become ahasd.stn. While encrypting files it will also create a ransom note called HELP_DECRYPT_FILES.html in each folder that a file has been encrypted.
When it has finished encrypting the computer, it will execute the C:\Windows\System32\cipher.exe” /W:C command to wipe all data from the unused space on the C: Drive.
Finally it will display the ransom note, which contains a unique victim ID and a URL to a TOR payment site.
Unfortunately, at this time there is no way to decrypt the files for free. For those who wish to discuss this ransomware or receive support, you can use our dedicated help topic: Satan Ransomware Help & Support Topic.
from : bleepingcomputer