Satana

Category: ransomware · Aliases: Ransomware.Satana, Trojan-Ransom.Win32.Satana, Bootlocker.Satana · Sample count (EMBER 2018): 1 · Enrichment: insufficient_information · Updated: 2026-07-02T07:38:22Z

Category: RansomwareActor: Unknown / CybercriminalIndustry: Global / OpportunisticMotivation: Opportunistic

Overview

Executive Summary

Satana is a highly destructive, hybrid ransomware variant that combines traditional file encryption with the catastrophic capabilities of a boot-locker. It not only encrypts the victim's valuable data files but also corrupts the Master Boot Record (MBR) of the hard drive, replacing the standard Windows boot sequence with a custom ransom note. This dual-pronged attack ensures the system is completely unbootable and the data is inaccessible until a ransom is paid.

Infection Vector and Technical Capabilities

Satana typically infiltrates networks via malicious spam campaigns (malspam) containing weaponized attachments, or it is dropped silently via exploit kits targeting unpatched web browsers. Once executed, Satana performs a complex, multi-stage attack:

MBR Overwrite (Boot-Locker): The ransomware attempts to overwrite the MBR (sector 0 of the physical drive) with its own malicious bootloader. When the infected machine reboots, it will not load Windows; instead, it displays a red screen demanding a cryptocurrency payment.
File Encryption: Simultaneously, Satana scans local drives and mapped network shares, utilizing strong cryptography (AES+RSA) to encrypt user files, databases, and documents, appending a specific extension to the locked files.
Evasion and Persistence: To ensure its payload is delivered, Satana attempts to disable Windows User Account Control (UAC) and actively targets specific security processes for termination before initiating the MBR overwrite.

Threat Assessment

A Satana infection is a catastrophic security incident. By targeting both the file system and the fundamental boot sector, it causes immediate, total operational paralysis. Even if the encrypted files are restored from backup, the machine will not boot until the MBR is repaired.

Incident Response and Remediation

Immediate Network Segmentation: Instantly sever the network connection of all infected machines to halt lateral movement and prevent the ransomware from encrypting mapped network shares.
MBR Repair (Offline): The machine cannot be booted normally. Incident responders must boot the system from a clean Windows Recovery USB/CD and utilize the `bootrec.exe /fixmbr` command to repair the Master Boot Record, which will remove the pre-boot ransom note and allow Windows to load.
Eradication and Data Recovery: Once the system is bootable, the underlying file encryption remains. The machine must be wiped to bare metal and completely rebuilt from known-good, offline backups. Do not attempt to pay the ransom.

Known aliases

Threat reports may refer to this family under multiple names:

MITRE ATT&CK Techniques

This family has been observed using the following ATT&CK techniques: T1486 T1561.002 T1490

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_SATANA {
    meta:
        description = "Detects Satana (ransomware)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "satana" ascii wide nocase
        $s2 = "ransomware.satana" ascii wide nocase
        $s3 = "trojan-ransom.win32.satana" ascii wide nocase
        $s4 = "bootlocker.satana" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Satana Activity
id: 425601542ed8174666919cf54348cec4
status: experimental
description: Detects generic indicators of the satana malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*satana*"
            - "*ransomware.satana*"
            - "*trojan-ransom.win32.satana*"
            - "*bootlocker.satana*"
    condition: selection
level: medium

References & External Analysis

Search "satana" on VirusTotal (External Analysis)

Frequently Asked Questions

How do I remove the Satana Ransomware from Windows?

Manual removal of Satana is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.

Is Satana a virus or a Ransomware?

Satana is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Satana typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.

What are the main symptoms of a Satana infection?

Symptoms of Satana can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.

Related Families (Category: ransomware)

Explore other malware families in the same category:

Protect Your Network Against Ransomwares

Want to prevent Satana and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Protection Guide.

Need help with an active incident? Published by the SystemHelpdesk team.

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/satana.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.