Detect the Prometheus's Thanos ransomware using the build ID and the Killproc strings.

Detect the Prometheus's Thanos ransomware.

Thanos Ransomware

Ransomware-as-a-service (RaaS) sold through underground forums.

Downloads MZ/PE file

Downloads PsExec from SysInternals website

Sysinternals tools like PsExec are often leveraged maliciously by malware families due to being commonly used by testers/administrators.

Modifies Windows Firewall

Modifies extensions of user files

Ransomware generally changes the extension on encrypted files.