{
  "family": "satana",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nSatana is a highly destructive, hybrid ransomware variant that combines traditional file encryption with the catastrophic capabilities of a boot-locker. It not only encrypts the victim's valuable data files but also corrupts the Master Boot Record (MBR) of the hard drive, replacing the standard Windows boot sequence with a custom ransom note. This dual-pronged attack ensures the system is completely unbootable and the data is inaccessible until a ransom is paid.\n\n<h3>Infection Vector and Technical Capabilities</h3>\nSatana typically infiltrates networks via malicious spam campaigns (malspam) containing weaponized attachments, or it is dropped silently via exploit kits targeting unpatched web browsers.\n\nOnce executed, Satana performs a complex, multi-stage attack:\n<ul>\n<li><strong>MBR Overwrite (Boot-Locker):</strong> The ransomware attempts to overwrite the MBR (sector 0 of the physical drive) with its own malicious bootloader. When the infected machine reboots, it will not load Windows; instead, it displays a red screen demanding a cryptocurrency payment.</li>\n<li><strong>File Encryption:</strong> Simultaneously, Satana scans local drives and mapped network shares, utilizing strong cryptography (AES+RSA) to encrypt user files, databases, and documents, appending a specific extension to the locked files.</li>\n<li><strong>Evasion and Persistence:</strong> To ensure its payload is delivered, Satana attempts to disable Windows User Account Control (UAC) and actively targets specific security processes for termination before initiating the MBR overwrite.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nA Satana infection is a catastrophic security incident. By targeting both the file system and the fundamental boot sector, it causes immediate, total operational paralysis. Even if the encrypted files are restored from backup, the machine will not boot until the MBR is repaired.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Immediate Network Segmentation:</strong> Instantly sever the network connection of all infected machines to halt lateral movement and prevent the ransomware from encrypting mapped network shares.</li>\n<li><strong>MBR Repair (Offline):</strong> The machine cannot be booted normally. Incident responders must boot the system from a clean Windows Recovery USB/CD and utilize the `bootrec.exe /fixmbr` command to repair the Master Boot Record, which will remove the pre-boot ransom note and allow Windows to load.</li>\n<li><strong>Eradication and Data Recovery:</strong> Once the system is bootable, the underlying file encryption remains. The machine must be wiped to bare metal and completely rebuilt from known-good, offline backups. Do not attempt to pay the ransom.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Ransomware.Satana",
    "Trojan-Ransom.Win32.Satana",
    "Bootlocker.Satana"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1486",
    "T1561.002",
    "T1490"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-02T07:38:22Z",
  "type": "Ransomware / Bootlocker",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}