General
-
Target
HEUR-Trojan-Ransom.MSIL.Thanos.gen-9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.exe
-
Size
123KB
-
Sample
220924-lm7xvsbaa8
-
MD5
14de196b28bc12b5e571ea8303668041
-
SHA1
7f400d518bd716e75c795de47e1dc67f9d29d582
-
SHA256
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b
-
SHA512
1fe6f312057ca6debe2552f02c231cacff60f79fc40c053c26500f58fe4575fd4c820883bb4203ead2e9db00402883389d72853f304d3e198a333ef49e387b6f
-
SSDEEP
3072:RdvedgwAwp9orNJUq11rfAEVMjOPsn94+fmVnj/:b4gnxMjO+9tfmVj
Static task
static1
Behavioral task
behavioral1
Sample
HEUR-Trojan-Ransom.MSIL.Thanos.gen-9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
HEUR-Trojan-Ransom.MSIL.Thanos.gen-9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.exe
Resource
win10v2004-20220812-en
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
prometheus
http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
prometheus
http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD
Extracted
C:\Users\Admin\AppData\Local\Temp\RESTORE_FILES_INFO.txt
prometheus
http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD
Extracted
C:\Users\Admin\Desktop\RESTORE_FILES_INFO.hta
prometheus
http://promethw27cbrcot.onion/ticket.php?track=54Z-YAD-AWLD
Targets
-
-
Target
HEUR-Trojan-Ransom.MSIL.Thanos.gen-9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b.exe
-
Size
123KB
-
MD5
14de196b28bc12b5e571ea8303668041
-
SHA1
7f400d518bd716e75c795de47e1dc67f9d29d582
-
SHA256
9d85a74f073c4403e3a91017b6757e0368139e672498a2f84f5efaad0d1b573b
-
SHA512
1fe6f312057ca6debe2552f02c231cacff60f79fc40c053c26500f58fe4575fd4c820883bb4203ead2e9db00402883389d72853f304d3e198a333ef49e387b6f
-
SSDEEP
3072:RdvedgwAwp9orNJUq11rfAEVMjOPsn94+fmVnj/:b4gnxMjO+9tfmVj
Score10/10-
Prometheus Ransomware
Ransomware family mostly targeting manufacturing industry and claims to be affiliated with REvil.
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Deletes itself
-
Drops startup file
-
Modifies file permissions
-
Modifies WinLogon
-