thanos | gVcWDWENI8[.]exe

Resubmissions

07/06/2021, 10:08

210607-9hpr7n82ba10

03/06/2021, 20:20

210603-mpsat3rm4j10

Sharing

Copy URL Twitter E-mail

General

Target
gVcWDWENI8.exe
Size 142KB
Sample210607-9hpr7n82ba
SHA256 8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
MD5 e1f063d63a75e0e0e864052b1a50ab06
SHA1 75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7
SHA512 25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3
MD5 SHA1 SHA512

Score

10^/10

ransomware thanos

Malware Config

Signatures

Detect the Prometheus's Thanos ransomware using the build ID and the Killproc strings. 1 IoCs

Detect the Prometheus's Thanos ransomware.

ransomware

resource	yara_rule
sample	ransomware_win_thanos

Thanos family
thanos

File Explorer

gVcWDWENI8.exe

.exe 142KB

gVcWDWENI8.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 8c723af5c826adea162ef3f2e37a1cca7b43d549c9a5fab7c9ff17f65eb5d8e7
MD5 e1f063d63a75e0e0e864052b1a50ab06
SHA1 75d941a28cf0ade2ef2c16dfacbdeb36a51ccaf7
SHA512 25681b210ee18bd60ba3fef496769283d51dc516569e1f1834d6d23a5927c1684b25ff67baf5fba66c908b364a13784f49facdde7a98b2fb8a8a41a2ec792ae3
MD5 SHA1 SHA512

windows x86

Detect the Prometheus's Thanos ransomware using the build ID and the Killproc strings.

Detect the Prometheus's Thanos ransomware.

ransomware

Minor OS version

Major OS version

Entry point

150782

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths