Malware
ROLLCOAST
aka Sabbath · S4bb47h · Arcane
ROLLCOAST is a ransomware program that encrypts files on logical drives attached to a system.
ROLLCOAST, also known as Sabbath, S4bb47h, Arcane, is a Windows malware family.
Background
ROLLCOAST is a ransomware program that encrypts files across the logical drives attached to a host. It takes the form of a Dynamic Linked Library (DLL) that exposes no named exports. In the sample Mandiant examined, it notably exported only a single ordinal, 0x01, implying the binary was meant to slip past detection and run from memory, perhaps via BEACON handed to affiliates. Responders dealing with comparable intrusions should preserve memory for analysis.
Source: Malpedia (Fraunhofer FKIE).