Friday, February 7, 2025
HomeMalwareSnake Ransomware That Written in Golang Language Removes Backup Shadows Copies &...

Snake Ransomware That Written in Golang Language Removes Backup Shadows Copies & Encrypt Windows Files

Published on

SIEM as a Service

Follow Us on Google News

Researchers observed new snake ransomware that written in Golang targeting Windows users to encrypt the system files and remove the Volume Shadow Copies that the OS uses for backup.

Snake ransomware is a targeted campaign that contains a standard ransomware feature with some of the more complex functionalities.

Malware authors choose the Golang language which is used to write some of the most recent ransomware families and utilized by some of the RaaS (Ransomware as a Service) offerings since it is flexible for cross-platform and completely open-source programming language.

Researchers believe that the campaign has the potential to do serious and critical damage to an infected environment. 

Snake ransomware targeting the specific platforms such as SCADA, enterprise management tools, system utilities and also some of the specific targeted applications include VMware Tools, Microsoft System Center Operations Manager, Nimbus, Honeywell HMIWeb, FLEXnet,

Snake Ransomware Infection

Once it infects the system, relevant files are overwritten with encrypted data, and the encrypted files extension is changed as ” EKANS”.

Also, modified files added with random characters which used to make it more difficult to identify the specific ransomware family.

Malware authors used both symmetric and asymmetric cryptography to encrypt the victim’s windows system files.

A symmetric key is required for encrypting and decrypting of files, In this case, symmetric key used to encrypt the victim’s files with attacker’s public key and the decryption process is only possible by having the attackers private key.

Since the attackers using key lengths (AES-256, RSA-2048), which makes it impossible to crack the key and decrypt the data.

Snake ransomware also terminates the various system process of following.

According to SentinelOne research, “If the threat is executed with administrative privileges, the ransom note will be written to c:\users\public\desktop\Fix-Your-Files.txt. In the event that administrative privileges are not present, the ransom note will be written to an alternative location: c:\users\\AppData\Local\VirtualStore\

Once the Snake ransomware completes the infection process and encrypted the system files, it drops the ransomware notes that contain the details about how to decrypt the files.

Ransom notes

Instead of providing the web address to obtain the payment, authors are instructed the victims to contact them via the email address in the ransom note is “bapcocrypt @ ctemplar.com” to get the decryption key from the attacker.

Must Read: Ransomware Attack Response and Mitigation Checklist

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Dell Update Manager Plugin Flaw Exposes Sensitive Data

Dell Technologies has issued a security advisory (DSA-2025-047) to address a vulnerability in the Dell Update...

DeepSeek iOS App Leaks Data to ByteDance Servers Without Encryption

DeepSeek iOS app—a highly popular AI assistant recently crowned as the top iOS app...

Critical Flaws in HPE Aruba ClearPass Expose Systems to Arbitrary Code Execution

Hewlett Packard Enterprise (HPE) has issued a high-priority security bulletin addressing multiple vulnerabilities in...

Splunk Introduces “DECEIVE” an AI-Powered Honeypot to Track Cyber Threats

Splunk has unveiled DECEIVE (DECeption with Evaluative Integrated Validation Engine), an innovative, AI-augmented honeypot that mimics...

Supply Chain Attack Prevention

Free Webinar - Supply Chain Attack Prevention

Recent attacks like Polyfill[.]io show how compromised third-party components become backdoors for hackers. PCI DSS 4.0’s Requirement 6.4.3 mandates stricter browser script controls, while Requirement 12.8 focuses on securing third-party providers.

Join Vivekanand Gopalan (VP of Products – Indusface) and Phani Deepak Akella (VP of Marketing – Indusface) as they break down these compliance requirements and share strategies to protect your applications from supply chain attacks.

Discussion points

Meeting PCI DSS 4.0 mandates.
Blocking malicious components and unauthorized JavaScript execution.
PIdentifying attack surfaces from third-party dependencies.
Preventing man-in-the-browser attacks with proactive monitoring.

More like this

Abyss Locker Ransomware Attacking Critical Network Devices including ESXi servers

The Abyss Locker ransomware, a relatively new but highly disruptive cyber threat, has been...

Flesh Stealer Malware Attacking Chrome, Firefox, and Edge Users to Steal Passwords

A newly identified malware, Flesh Stealer, is rapidly emerging as a significant cybersecurity threat...

Beware of Nova Stealer Malware Sold for $50 on Hacking Forums

The cybersecurity landscape faces a new challenge with the emergence of Nova Stealer, a...