Wapack Analysts are researching a C-based Ransomware-as-a-Service (RaaS), that uses AES256 encryption, remains undetected against any antivirus, and is a dangerous ransomware platform being distributed on several, high-profiled underground forums. Unlike other ransomware services that charge users a percentage of the ransom payment, this C-based RaaS charges an up-front fee to use the service. It provides three packages for RaaS services; all which provide access to a C-based Fully Undetectable (FUD) ransomware and a crypter with TOR based C&Cs and panel.
Wapack Labs has cataloged and reported extensively on ransomware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.
Satan Ransomware-as-a-Service (RaaS) is similar to previous RaaS platforms but employs far superior default obfuscation and evasion techniques. Most RaaS payloads are highly detectable and require the use of a “crypter,” while Satan provides XoR functions to encode and other means of delivering/proxying fully undetectable (FUD) payloads.
With Petya, Mischa, and Shark RaaS platforms no longer in underground operation, Satan is the most popular and free RaaS platform; making it very attractive to black hat hackers. Several members are utilizing Satan RaaS and reporting pending victim payments...READ MORE
Wapack Labs has extensively reported on ransomware in the past. An archive of related reporting can be found in the Red Sky Alliance portal.
TLP: AMBER
ACTOR TYPE: (III)
SERIAL: IA-009-2017
COUNTRIES: All
INDUSTRIES: All
REPORT DATE: 20170307
Wapack Analysts are researching a C-based Ransomware-as-a-Service (RaaS), that uses AES256 encryption, remains undetected against any antivirus, and is a dangerous ransomware platform being distributed on several, high-profiled underground forums. Unlike other ransomware services that charge users a percentage of the ransom payment, this C-based RaaS charges an up-front fee to use the service. It provides three packages for RaaS services; all which provide access to a C-based Fully Undetectable (FUD) ransomware and a crypter with TOR based C&Cs and panel.
