Ransomware Research
Satan Ransomware
Satan is a malicious ransomware strain that encrypts victim files and demands ransom payment for decryption. First observed in the wild on January 1, 2017, this ransomware has been actively targeting systems worldwide.
Quick Facts
- Ransomware Family
- Satan
- First Seen
- January 1, 2017
How Satan Ransomware Works
Targeted Files
174bd49a9a4913bd482a496128a26e29591f27919197ce38e062c9d91ca7ab00 -> requires C&C (doesnt work)
File Encryption Patterns
Satan modifies encrypted files using specific patterns to mark them as encrypted:
File extensions added after encryption:
..stn
Ransom Note and Payment Demands
After encrypting files, Satan displays ransom notes demanding payment for file recovery:
HELP_DECRYPT_FILES.html
Ransom message:
notes/HELP_DECRYPT_FILES.html.txt
0_HELP_DECRYPT_FILES.html
Technical Indicators
Associated Executable Files
The following executable files are associated with Satan ransomware:
raas.exe
Satan2.exe
ransome.exe
ransom.exe
RAAS RANSOMWARE
satan.exe
ransomware3.exe
Elastio Can Help You
Don't let Satan ransomware take over your data
Elastio provides advanced ransomware protection and recovery solutions to keep your organization safe.
About This Analysis
This Satan ransomware analysis is part of Elastio's comprehensive ransomware detection database. Elastio provides advanced ransomware protection and recovery solutions, helping organizations defend against and recover from ransomware attacks like Satan.
Last updated: July 30, 2025