Menu
New Satana ransomware encrypts user files and master boot record

New Satana ransomware encrypts user files and master boot record

It's the second ransomware threat after Petya that leaves computers unable to boot into the OS

Attackers are developing an aggressive new ransomware program for Windows machines that encrypts user files as well as the computer's master boot record (MBR), leaving devices unable to load the OS.

The program is dubbed Satana -- meaning "Satan" in Italian and Romanian -- and, according to researchers from security firm Malwarebytes, it is functional but still under development.

Satana is the second ransomware threat affecting the MBR and seems inspired by another program, Petya, that appeared in March.

The MBR code is stored in the first sectors of a hard disk drive, contains information about the disk's partitions and launches the operating system's boot loader. Without a proper MBR, computers don't know which partitions contain the OS and how to start it.

There are significant differences between Satana and Petya. For example, Petya replaces the MBR in order to launch a custom bootloader that then encrypts the system's master file table (MFT) -- a special file on NTFS partitions that contains information about all other files, like names, sizes and mappings to the hard disk sectors.

Satana doesn't encrypt the MFT. It just replaces the MBR with its own code and stores an encrypted version of the original boot record so it can restore it later if the victim pays the ransom. This leaves the computer unbootable, but can be fixed more easily than if the MFT had also been encrypted.

In May, Petya was combined with a separate ransomware program, called Mischa, which exhibits a more traditional behavior: it encrypts users' personal files directly if it can't obtain administrator privileges to attack the MBR and MFT.

Satana uses the same combination of traditional file encryption and MBR encryption, but in the same program. It first encrypts user files with specific extensions and then waits patiently for the first reboot, at which time it replaces the MBR. The user then sees a screen demanding a ransom payment of 0.5 bitcoin (about US$340).

This routine makes it harder for nontechnical users to restore their systems, because it forces them to use a separate computer to make the payment, as the affected computer can no longer boot into Windows.

"Unfortunately, at this time there is no way to decrypt Satana encrypted files for free," said Lawrence Abrams, founder of the BleepingComputer.com tech support forum, in a blog post.

Users might be able to repair the MBR by using the Windows recovery options, but this requires working with the Windows command line and the bootrec.exe (boot recovery) tool, so it is likely beyond the abilities of typical users.

The current version of Satana hasn’t yet been widely distributed, and the researchers don’t expect that it will because the code is not yet mature and has flaws. However, they believe this version will likely serve as a base for future improvements.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Events

Featured

Slideshows

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners

This year’s Reseller News 30 Under 30 Tech Awards were held as an integral part of the first entirely virtual Emerging Leaders​ forum, an annual event dedicated to identifying, educating and showcasing the New Zealand technology market’s rising stars. The 30 Under 30 Tech Awards 2020 recognised the outstanding achievements and business excellence of 30 talented individuals​, across both young leaders and those just starting out. In this slideshow, Reseller News honours this year's winners and captures their thoughts about how their ideas of leadership have changed over time.​

Meet the Reseller News 30 Under 30 Tech Awards 2020 winners
Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security

This exclusive Reseller News Exchange event in Auckland explored the challenges facing the partner community on the cloud security frontier, as well as market trends, customer priorities and how the channel can capitalise on the opportunities available. In association with Arrow, Bitdefender, Exclusive Networks, Fortinet and Palo Alto Networks. Photos by Gino Demeer.

Reseller News Exchange Auckland: Beyond the myths — how partners can master cloud security
Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomes industry figures at 2020 Hall of Fame lunch

Reseller News welcomed 2019 inductees - Leanne Buer, Ross Jenkins and Terry Dunn - to the fourth running of the Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed the changing face of the IT channel ecosystem in New Zealand and what it means to be a Reseller News Hall of Fame inductee. Photos by Gino Demeer.

Reseller News welcomes industry figures at 2020 Hall of Fame lunch
Show Comments