The SNAKE is a new ransomware that is threatening enterprises worldwide along with most popular ransomware families such as Ryuk, Maze, Sodinokibi, LockerGoga, BitPaymer, DoppelPaymer, MegaCortex, LockerGoga.
The scary trend sees criminal organizations targeting enterprises, instead of single users, using the above malware to maximize their profits.
Snake Ransomware was first detected by researchers from MalwareHunterTeam last week and analyzed it with the support of the popular malware analysts Vitali Kremez.
The ransomware is written in Golang and is heavily obfuscated, it is designed to target the entire network rather than individual computers or servers.
“The ransomware contains a level of routine
Like other ransomware, upon execution Snake will remove the computer’s Shadow Volume Copies, it
Then the malware encrypts the files on the system, skipping Windows system files and folders. The SNAKE ransomware appends a ransom 5 character string to the
The experts noticed that the malware appends the ‘EKANS‘ file marker to each encrypted file.
“As this is targeted ransomware that is executed at the time of the attacker’s choosing, this may not be that much of a problem as the encryption will most likely occur after hours.”
Once the encryption process is completed the ransomware will create a ransom note (named ‘Fix-Your-Files.txt’) in the C:\Users\Public\Desktop folder that contains the email address ([email protected])
Technical details, including IoCs, are reported in the analysis published by BleepingComputer.
|[adrotate banner=”9″]||[adrotate banner=”12″]|