Saturn Ransomware

Saturn Ransomware

 

 

A Brief Overview

A new Ransomware was discovered this week by MalwareHunter Team called Saturn. Once your machine get infected with this, it encrypts all your file and append .saturn extension to the file’s name (ex: original file name: test.png after ransomware attack file converted into test.png.saturn).

This ransomware is being actively distributed and now it is unknown what distribution methods are being used. Method could be any like directly send it as an attachment in message, insert as a hyperlink to the malicious attacker owned web portal once click can redirects to hacker-controlled sites, infected payloads or other instances that can lead to a Saturn Virus infection.

Impact of Saturn Virus:

·         Saturn file virus infects the web browsers and modify settings associated with their homepage, default search engine and new tab URL.

·         Further it inserts various kind of irrelevant ads and pop ups which causes troubles in web surfing to them.

·         Moreover, it encrypts the files and makes them inaccessible for users.

·         Later users are asked to pay ransom amount in Bitcoins to have the decryption key.

How Saturn Ransomware encrypts a Machine’s Data

Once the Saturn Ransomware Installed on your computer it checks weather the victim is running in a virtual environment or not. If it will identify the victim running under virtual machine, it will exit the process. If it doesn’t detect the virtual machine, Saturn executes the following command.

1.      Delete shadow copies

2.      Disable windows start-up repair

3.      Clear the windows backup catalog

After executing the above commands, it scan the system for certain file types as below and encrypt them.

While encrypting Files it will append .saturn extension to the encrypted file’s name as shown below:

While Encrypting the system, Saturn Ransomware drop a ransom notes named #Decrypt_MY_FILES#.html and #Decrypt_MY_FILES#.txt and a key file name #key-[id].key in each folder. This key file is used to login into the TOR ransom site, and a link to the TOR payment site at http://su34pwhpcafeiztt.com.onion.

A Screen of Ransomware Note

The ransomware also drop a #DECRYPT_MY_FILES#.vbs file that causes speech to come from the infected computer. Finally, it sets your Windows desktop background to #DECRYPT_MY_FILES.BMP.

When a user visits the TOR site, they will be prompted to upload the key file before accessing their personal portal.

Once the key is uploaded, it will open the Saturn Decryptor page for the victim and display more detailed instructions. These instructions will contain the amount of bitcoins to send as a ransom and the bitcoin address that it should be sent to. Currently, the ransom amount is set to $300 USD and might increase as time fly.

Precaution to secure from Saturn Ransomware

·         Always have tested backup of data

·         Do not expose remote desktop services, instead use VPN to get access of Remote Server

·   Use Security Software like Anti-malware (http://bestsecuritysearch.com/download-install-spyhunter-anti-malware-tool/ )

·         Do not open any attachment without confirming and scan each attachment before downloading

·         Keep upgrading or updating all software/framework along with latest patches and hotfixes.

·         Don’t use weak and repeated password. Use strong complex password which is hard to crack.

·         Periodic scan of all servers, workstations and other devices within the infrastructure.

References:

·        https://www.pcmalwaresecurity.com/ransomware/remove-saturn-ransomware-virus-completely-windows-pc/

·         https://www.2-spyware.com/remove-saturn-ransomware.html

·         https://en.wikipedia.org/wiki/Ransomware