General
-
Target
Thanos Ransomware Builder.7z
-
Size
24.4MB
-
Sample
230823-lcsp7acf2t
-
MD5
a0aba132e8dc63ac6a7b93287d2052fb
-
SHA1
ee705bcce8e28a2d068a9697595626392b19cd7b
-
SHA256
9a1d0f0dc5d3a04e100e1bcc0111652fbd445156e804c11674d5aecaa8fd50ee
-
SHA512
eee808322ebb3cf451286883cfab78d4d5a0ca70367a01b3c946b1b291bf87e847887a95eb442c8d00b73302db8b02b24532741576a609dffc2197c2adabf262
-
SSDEEP
786432:fLEg/Jt7OLwcXBGdN6lBH+3nrUbhhvAA0mHcVgVDr1:DE4tSLFXBG7j3rUbEA0s
Static task
static1
Behavioral task
behavioral1
Sample
BuilderThanosRansomware/Thanos Builder.exe
Resource
win10v2004-20230703-en
Behavioral task
behavioral2
Sample
BuilderThanosRansomware/Thanos Decryptor.exe
Resource
win10v2004-20230703-en
Malware Config
Targets
-
-
Target
BuilderThanosRansomware/Thanos Builder.exe
-
Size
23.5MB
-
MD5
df3b0e83d439b16950893b0b44028f72
-
SHA1
f13b22a6c140c2518e6581b300caf9f8876af85a
-
SHA256
b94c888786bd50610331593396e80c1777ce0c54bb2f049338e31f98c2a61215
-
SHA512
65af4bb798419b32f96d09e5363a1ef00ea3b45558c78d36e66978e2443133a7b503033b79a6d59df72e78fe92443f870e101973bdb8f2298d59c5b9634fc436
-
SSDEEP
393216:BPxVn/38YHDlhKVwtPuExeC+V7wWYb0uwScC/9oD9HSHyO63y48Hvx:BPxV/bKIPuEn+VUv+cmQZ
Score10/10-
Chaos Ransomware
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload
-
Drops startup file
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Legitimate hosting services abused for malware hosting/C2
-
Sets desktop wallpaper using registry
-
-
-
Target
BuilderThanosRansomware/Thanos Decryptor.exe
-
Size
1.6MB
-
MD5
343c1af744b500fbb2fe9e9f4e88252a
-
SHA1
90706ffc62f7fbe952e262f891783b6df868b461
-
SHA256
b218562b19614c2857cbc4f46816702d1c7d5c06a4b8d572a6a2a626fdba3e87
-
SHA512
21235e7b29938e0fbc9321e66f99daf9543391c4a32a02431308e022a9232478e4ea637beaece022b16484119d529d576fe7645def3fbaf14281b728f4bf4852
-
SSDEEP
49152:fTLFrJ9ocJ02qqXsxISYmhZZRAtwkIuVIuIQ:7RJ9oc1qqcxIS3EtrIuCQ
Score3/10 -