Overview

overview

10

Static

static

10

5d40615701...3d.exe

windows7-x64

5d40615701...3d.exe

windows10-2004-x64

9

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Ransomware.Thanos.zip

  • Size

    145KB

  • Sample

    231214-214qcsadd4

  • MD5

    00184463f3b071369d60353c692be6f0

  • SHA1

    d3c1e90f39da2997ef4888b54d706b1a1fde642a

  • SHA256

    cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

  • SHA512

    baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006

  • SSDEEP

    3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD

Score
10/10
thanosransomware

Malware Config

Targets

    • Target

      5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d

    • Size

      91KB

    • MD5

      be60e389a0108b2871dff12dfbb542ac

    • SHA1

      14b4e0bfac64ec0f837f84ab1780ca7ced8d670d

    • SHA256

      5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d

    • SHA512

      6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641

    • SSDEEP

      1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI

    Score
    9/10
    ransomware

    • Renames multiple (75) files with added filename extension

      This suggests ransomware activity of encrypting all the files on the system.

      ransomware

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks