[heart888]

Satana Ransomware
https://virustotal.com/en/file/683a09da ... /analysis/

https://blog.malwarebytes.com/threat-an ... ansomware/

[xors]

Unpacked in the attachment ( For those who don't have an account on malwr.com)

The unpacking process is easy. Just put a breakpoint on RtlDecompressBuffer

[xors]

https://malwr.com/analysis/Njk0OWRkMTRh ... JlYzI5MWE/

The email that is in your zip file has been used by satana ransomware

[heart888]

Unpacked in the attachment ( For those who don't have an account on malwr.com)

The unpacking process is easy. Just put a breakpoint on RtlDecompressBuffer

did hbp on it..
but mine crashed, with error msg

Debugged application message: on_tls_callback3
Debugged application message: EntryPoint-4
40281A: The instruction at 0x40281A referenced memory at 0x0. The memory could not be read -> 0 (exc.code c0000005, tid 3168)

Any thoughts? TIA

[ea56f45e66e2c]

Unpacked in the attachment ( For those who don't have an account on malwr.com)

The unpacking process is easy. Just put a breakpoint on RtlDecompressBuffer

did hbp on it..
but mine crashed, with error msg

Debugged application message: on_tls_callback3
Debugged application message: EntryPoint-4
40281A: The instruction at 0x40281A referenced memory at 0x0. The memory could not be read -> 0 (exc.code c0000005, tid 3168)

Any thoughts? TIA

There are some common anti-debug tricks, try using ScyllaHide or equivalent. Also you can refer to this : http://adelmas.com/blog/satana.php
Hope this helps