Satan ransomware adds EternalBlue exploit

Technical analysis of a Satan ransomware variant shows it uses EternalBlue and DoublePulsar to spread via SMB, downloads components (sts.exe, ms.exe, client.exe) from 198.55.107.149 with a custom User-Agent, drops Cryptor.exe, kills database processes, excludes specific directories, and appends .satan while tagging files with [email protected]; it communicates with a C2, creates mutex SATANAPP, demands 0.3 BTC, and includes detailed IOCs (hashes, IPs, file paths, commands, BTC wallet) along with disinfection and MS17-010 patching guidance.