Pierluigi Paganini January 08, 2020

A new piece of ransomware called SNAKE appeared in threat landscape, the malware is now targeting company networks.

The SNAKE is a new ransomware that is threatening enterprises worldwide along with most popular ransomware families such as Ryuk, Maze, Sodinokibi, LockerGoga, BitPaymer, DoppelPaymer, MegaCortex, LockerGoga.

The scary trend sees criminal organizations targeting enterprises, instead of single users, using the above malware to maximize their profits.

Snake Ransomware was first detected by researchers from MalwareHunterTeam last week and analyzed it with the support of the popular malware analysts Vitali Kremez.

The ransomware is written in Golang and is heavily obfuscated, it is designed to target the entire network rather than individual computers or servers.

“The ransomware contains a level of routine obfuscation not previously and typically seen coupled with the targeted approach,” Kremez, Head of SentinelLabs, told BleepingComputer.

Like other ransomware, upon execution Snake will remove the computer’s Shadow Volume Copies, it also kills numerous processes related to SCADA systems, virtual machines, industrial control systems, remote management tools, network management software, and more.

Then the malware encrypts the files on the system, skipping Windows system files and folders. The SNAKE ransomware appends a ransom 5 character string to the files extension (i.e. a file named invoice.doc is encrypted and renamed like invoice.docIksrt.

The experts noticed that the malware appends the ‘EKANS‘ file marker to each encrypted file.

“BleepingComputer has tested many ransomware infections since 2013 and for some reason, it took Snake particularly long time to encrypt our small test box compared to many other ransomware infections.” reads the analysis published by BleepingComputer.

“As this is targeted ransomware that is executed at the time of the attacker’s choosing, this may not be that much of a problem as the encryption will most likely occur after hours.”

Once the encryption process is completed the ransomware will create a ransom note (named ‘Fix-Your-Files.txt’) in the C:\Users\Public\Desktop folder that contains the email address ([email protected]) to contact to receive the payment instructions.

According to BleepingComputer, the gang is offering the decryptor for the entire network and not individual machines.

Technical details, including IoCs, are reported in the analysis published by BleepingComputer.

Pierluigi Paganini

(SecurityAffairs – SNAKE ransomware, malware)

[adrotate banner=”5″]

[adrotate banner=”13″]