Latest Saturn Ransomware as a Service (RaaS) Allows Everyone to Become Ransomware Distributor

What is Saturn Malware?

During encryption, Saturn adds filenames with the ".saturn" extension (e.g., "sample.jpg" is renamed to "sample.jpg.saturn"). From this point, files become unusable. Following successful encryption, Saturn creates five files ("#DECRYPT_MY_FILES#.vbs", "#DECRYPT_MY_FILES.BMP" [also set as desktop wallpaper], "#DECRYPT_MY_FILES#.txt", "#DECRYPT_MY_FILES#.html", and "#KEY-dea23dbdbbfeba538e0c3aac3751331d.KEY"), placing them on the desktop. The BMP, TXT, and HTML files contain ransom-demand messages.

Saturn is marketed and used as a RaaS - 'Ransomware as a Service'. This revenue-generating program is very convenient for the developers, since they put least effort into distribution - the third parties does most of the efforts for them. The developers simply work on profit share payments received. The new infected files contain messages informing the victims of the encryption and compels the victim to pay a ransom in exchange for decryption of the files. The Saturn Ransomware behaves similar to the Tornado Ransomware and the Tear Dr0p Ransomware. The victim will find that the downloaded videos and audio records, as well as family photos, databases and office documents are locked. The Saturn Ransomware might encode data containers with the following extensions:

.3gp, .7z, .apk, .avi, .bmp, .cdr, .cer, .chm, .conf, .css, .csv, .dat, .db, .dbf, .djvu, .dbx, .docm, ,doc, .epub, .docx .fb2, .flv, .gif, .gz, .iso .ibooks,.jpeg, .jpg, .key, .mdb .md2, .mdf, .mht, .mobi .mhtm, .mkv, .mov, .mp3, .mp4, .mpg .mpeg, .pict, .pdf, .pps, .pkg, .png, .ppt .pptx, .ppsx, .psd, .rar, .rtf, .scr, .swf, .sav, .tiff, .tif, .tbl, .torrent, .txt, .vsd, .wmv, .xls, .xlsx, .xps, .xml, .ckp, .zip, .java, .py, .asm, .c, .cpp, .cs, .js, .php, .dacpac, .rbw, .rb, .mrg, .dcx, .db3, .sql, .sqlite3, .sqlite, .sqlitedb, .psd, .psp, .pdb, .dxf, .dwg, .drw, .casb, .ccp, .cal, .cmx, .cr2.

Also read- How To Remove Adamant.pristineapp.com Redirect Virus From Computer?

Although it is currently not clear whether Saturn uses symmetric or asymmetric cryptography, decryption requires a key generated uniquely for each victim. These keys are stored on a remote server controlled by Saturn's developers and victims are encouraged to pay a ransom for their release. The cost of decryption is $300 in Bitcoins; however, payment must be submitted within seven days, otherwise the cost will double. After one month, files are corrupted permanently. Despite the threats and demands, we strongly advise you to ignore all requests to submit payments. Research shows that cyber criminals often ignore victims, once ransoms are paid. In other words, paying gives no positive result and you will be scammed. We strongly advise you not to contact these people or pay ransoms. Unfortunately, there are no tools capable of restoring files compromised by Saturn free of charge. The only solution is to restore everything from a backup.

How does this Saturn Malware infect your system?

1. Bundling: Through third party installers by concealing itself in freeware installation. It comes bundled with free application hosted from unreliable site. When user install those free application then this infection also gets installed automatically.  
2. It can also get attached with on your PC, if you frequently visit unsafe site like Porn sites or betting sites which contain illegal stuff. In addition, user should also avoid clicking on misleading ads and random links which redirects the victim to social media site.   
3. It gets inside your system along with the installation of any new software applications which the user does without completely reading license agreements or reading without terms and condition. Most of these cases are sharing files like music, photos and many more in networking environment, visiting various adult websites are also liable behind the insertion of this threat inside your system.
4. Attachments send via emails or Facebook, Skype messages. This trap is genuinely old, however it is always getting enhanced. The most recent hit is to influence it to look an associate sent you that email and it will also incorporate what seem, by all accounts, to be business related documents inside. Make sure to search for the file attachment before you take a gander at the document name. If it closes with .exe or it is .exe file then it’s most likely an infection!
5. Spam emails: This browser hijacker gets into your computer through malicious email attachments in the spam emails tab. malicious infected attachments and download links in an unknown email.
6. Carelessness-It gets installed when you click unintentionally on any infected link. Always pay attention while clicking on unsafe links or unknown links.
7. Torrents & P2P File Sharing: Online Ads are another common culprit. Torrent sites especially are well known for their tricks involving multiple fake download buttons. If you click on the wrong button you’ll get a file to download that is named exactly like the file you want. Unfortunately, what’s inside is actually the virus.
8. Fake download websites are another wellspring of hijacker programs. These websites have worked in calculations, which enable them to duplicate your search queries and influence the search engines to trust they have an ideal match for your search. When you endeavor to download a file from such a webpage the name will fit, but the file that you have downloaded are really going to be loaded with infections, viruses, malwares and other threats. So, it is never a smart thought to open documents got from arbitrary sources without scanning them for infections first. Always keep an anti-virus program on your machine.

Common symptoms of Saturn Malware:

1. Unstable behavior of the browser, frequent crashes.
2. This hazardous threat can also change the desktop background with a ransom image.
3. Your web browsers are now equipped with all new add-ons toolbars and extensions.
4. Every time you go online searching your something you get redirected to the target portal or to fake security warning which would want you to download a program to fix your computer.
5. Poor system performance, slow response time as the advertisement would pop out of nowhere on the screen even when the browser is disabled.
6. Slow internet browsing speed or internet would stop unexpectedly.
7. The operating system would crash now and then, or computer would boot up for no reason.
8. New icons are added or suspicious programs appear on the desktop screen out of nowhere.
9. Certain system setting and browser settings are disabled or changed.

Download Free Removal Tool

Tips to prevent Saturn Malware from entering your computer :