What happens when ransomware developers combine two already-aggressive viruses into one Mega Strain?
Satana.
Satana is the Italian word for Satan, and the title is apropos. It is a devastating two-step combination of malware-strain, Petya, and ransomware, Mischa. And though the two have a shared history, with Mischa playing backup in case Petya fails, it looks like Mischa got a promotion; this is the first time the two strains have actually worked as partners.
Satana is differentiates itself from everyday ransomware, which encrypts individual files one-by-one, by using Petya to penetrate the computer’s lower level structures and then blocks user access. Like Petya, Satana uses the traditional portable executable (PE) file to do this and then uses a small, customized kernel to not only infiltrate the bootloader but to re-write it, as well.
After Petya has been utilized, the virus calls on Mischa, who, like the typical ransomware, will encrypt files individually and then instruct the user on how to deliver the ransom by triggering a notification that stays on the screen until the user clicks “Yes.” Silently, without creating any error screens, Satana begins to write its malevolent code in the temporary files of the computer while encrypting targeted files. After the files are encrypted, Satana just waits, lurking in the shadows like the true predator it is, for the user to reboot the system. The user has no idea the files have been hijacked until the ransom pops up after the computer has been turned back on.
Fortunately, Satana appears to be only in the early stages of development. While it has the potential to be extremely destructive, it also displays some major flaws. It announces every action it takes, and the code does not appear to be very refined.
That being said, it is almost inevitable that the next version will not be so buggy, as Satana has the potential to be a very strong virus.
In the meantime, it is important for computer owners to take action. Make sure to backup your data regularly, and do not download anything that looks suspicious. Also make sure that your friends, family members, coworkers and employees are aware of the latest threats so they do not fall victim, either.