General

  • Target

    Thanos Ransomware Builder.7z

  • Size

    24.4MB

  • Sample

    230823-lcsp7acf2t

  • MD5

    a0aba132e8dc63ac6a7b93287d2052fb

  • SHA1

    ee705bcce8e28a2d068a9697595626392b19cd7b

  • SHA256

    9a1d0f0dc5d3a04e100e1bcc0111652fbd445156e804c11674d5aecaa8fd50ee

  • SHA512

    eee808322ebb3cf451286883cfab78d4d5a0ca70367a01b3c946b1b291bf87e847887a95eb442c8d00b73302db8b02b24532741576a609dffc2197c2adabf262

  • SSDEEP

    786432:fLEg/Jt7OLwcXBGdN6lBH+3nrUbhhvAA0mHcVgVDr1:DE4tSLFXBG7j3rUbEA0s

Malware Config

Targets

    • Target

      BuilderThanosRansomware/Thanos Builder.exe

    • Size

      23.5MB

    • MD5

      df3b0e83d439b16950893b0b44028f72

    • SHA1

      f13b22a6c140c2518e6581b300caf9f8876af85a

    • SHA256

      b94c888786bd50610331593396e80c1777ce0c54bb2f049338e31f98c2a61215

    • SHA512

      65af4bb798419b32f96d09e5363a1ef00ea3b45558c78d36e66978e2443133a7b503033b79a6d59df72e78fe92443f870e101973bdb8f2298d59c5b9634fc436

    • SSDEEP

      393216:BPxVn/38YHDlhKVwtPuExeC+V7wWYb0uwScC/9oD9HSHyO63y48Hvx:BPxV/bKIPuEn+VUv+cmQZ

    • Chaos

      Ransomware family first seen in June 2021.

    • Chaos Ransomware

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    • RedLine payload

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Sets desktop wallpaper using registry

    • Target

      BuilderThanosRansomware/Thanos Decryptor.exe

    • Size

      1.6MB

    • MD5

      343c1af744b500fbb2fe9e9f4e88252a

    • SHA1

      90706ffc62f7fbe952e262f891783b6df868b461

    • SHA256

      b218562b19614c2857cbc4f46816702d1c7d5c06a4b8d572a6a2a626fdba3e87

    • SHA512

      21235e7b29938e0fbc9321e66f99daf9543391c4a32a02431308e022a9232478e4ea637beaece022b16484119d529d576fe7645def3fbaf14281b728f4bf4852

    • SSDEEP

      49152:fTLFrJ9ocJ02qqXsxISYmhZZRAtwkIuVIuIQ:7RJ9oc1qqcxIS3EtrIuCQ

    Score
    3/10

MITRE ATT&CK Enterprise v15

Tasks