{
  "family": "satan",
  "sample_count": 26,
  "category": "ransomware",
  "description": "Satan (also known as Satan Ransomware, later rebranded as DBatLoader / Lucky Ransomware, and tracked under signatures including Ransom:Win32/Satan, Trojan-Ransom.Win32.Satan, and Ransom:Linux/Satan) is a landmark Ransomware-as-a-Service (RaaS) platform active since January 2017. Created by cybercriminals to democratize ransomware deployment, Satan operated an underground web portal where affiliates generated customized ransomware binaries and tracked extortion payments. Notably evolving into a multi-platform threat targeting Windows and Linux servers, Satan incorporates worm-like self-propagation capabilities, scanning internal subnets and exploiting known enterprise vulnerabilities—including EternalBlue (CVE-2017-0144), JBoss (CVE-2017-12149), Tomcat, and WebLogic (CVE-2017-10271)—to compromise enterprise servers and encrypt file systems using AES-256 and RSA-2048 encryption.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Ransom:Win32/Satan",
    "Trojan-Ransom.Win32.Satan",
    "Lucky Ransomware",
    "Satan RaaS",
    "Win32/Satan",
    "Ransom:Linux/Satan"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is the Satan (Lucky) Ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Satan is a landmark Ransomware-as-a-Service (RaaS) family featuring worm-like lateral propagation exploiting server vulnerabilities."
      }
    },
    {
      "@type": "Question",
      "name": "Which vulnerabilities are exploited by Satan to propagate?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Satan exploits EternalBlue (CVE-2017-0144), WebLogic (CVE-2017-10271), JBoss (CVE-2017-12149), and Apache Tomcat servers."
      }
    },
    {
      "@type": "Question",
      "name": "What platforms are targeted by Satan ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It targets both Windows endpoints and Linux enterprise servers, deploying tailored encryption payloads for each OS."
      }
    },
    {
      "@type": "Question",
      "name": "How does Satan operate on the Ransomware-as-a-Service model?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The developer provided a web portal allowing affiliates to customize ransom amounts and split ransom proceeds with the author."
      }
    },
    {
      "@type": "Question",
      "name": "How can organizations defend against Satan ransomware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Apply security patches for EternalBlue and WebLogic, segment internal networks, and maintain offline immutable backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1486",
    "T1210",
    "T1490",
    "T1082",
    "T1547.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2017,
  "threat_actor": null,
  "delivery_mechanism": [
    "Worm Propagation via Exploits (EternalBlue, WebLogic)",
    "Spear-Phishing Emails with Weaponized Documents",
    "Ransomware-as-a-Service Affiliate Campaigns"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2019/2016",
    "Linux Enterprise Servers"
  ],
  "capabilities": [
    "Worm-Like Network Vulnerability Scanning & Exploitation",
    "AES-256 / RSA-2048 Multi-Platform Encryption",
    "Volume Shadow Copy Purging (vssadmin)",
    "Server Application Targeting (Databases, Web Servers)",
    "Automated RaaS Affiliate Telemetry & Key Generation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable",
      "Linux ELF Binary",
      "Ransom Note Text / HTML File"
    ],
    "network_signatures": [
      "High-frequency internal port scans targeting ports 445 (SMB), 7001 (WebLogic), and 8080 (Tomcat/JBoss)",
      "HTTP POST communications with Tor-routed or direct C2 servers transmitting encryption victim tokens"
    ],
    "evasion_techniques": [
      "Terminating enterprise database services (MySQL, Oracle, MSSQL) to release file handles before encryption",
      "Dynamic API resolution via PEB hash lookups to conceal exploitation payloads"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "7bc8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6",
      "8cd9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f7"
    ],
    "registry_keys": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SatanLocker",
      "HKLM\\SOFTWARE\\SatanRansom"
    ],
    "file_paths": [
      "%Temp%\\satan.exe",
      "%Desktop%\\HELP_DECRYPT_YOUR_FILES.html",
      "/tmp/satan_elf"
    ]
  },
  "defensive_measures": [
    "Immediately apply patches for MS17-010 (EternalBlue) and WebLogic deserialization vulnerabilities (CVE-2017-10271)",
    "Enforce internal network microsegmentation to block SMB and RPC propagation between client subnets",
    "Maintain immutable, air-gapped backups to guarantee recovery without paying ransom demands"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - Ransom:Win32/Satan",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Satan"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Ransom.Win32.Satan",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "Ransom:Win32/Satan.A",
      "Lucky Ransomware"
    ]
  },
  "motivation": "Financial Extortion, Multi-Platform Enterprise Ransomware & Affiliate Revenue",
  "sample_hashes": []
}