thanos | cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787

Sharing

Copy URL

Twitter E-mail

General

Target

Ransomware.Thanos.zip
Size

145KB
Sample

240219-rtr3waee82
MD5

00184463f3b071369d60353c692be6f0
SHA1

d3c1e90f39da2997ef4888b54d706b1a1fde642a
SHA256

cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
SHA512

baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
SSDEEP

3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD

Score

10^/10

Malware Config

Targets

- Target
  
  Ransomware.Thanos.zip
- Size
  
  145KB
- MD5
  
  00184463f3b071369d60353c692be6f0
- SHA1
  
  d3c1e90f39da2997ef4888b54d706b1a1fde642a
- SHA256
  
  cd0f55dd00111251cd580c7e7cc1d17448faf27e4ef39818d75ce330628c7787
- SHA512
  
  baa931a23ecbcb15dda6a1dc46d65fd74b46ccea8891c48f0822a8a10092b7d4f7ea1dc971946a161ac861f0aa8b99362d5bea960b47b10f8c91e33d1b018006
- SSDEEP
  
  3072:fn8L7y+NJQpRhkU0kbH2PNo/1GjTqOncYIOSsk:f8L7xNJQFzCo/ojTqOnYD
Score

1^/10
behavioral1 behavioral2 behavioral3 behavioral4
- Target
  
  58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- Size
  
  82KB
- MD5
  
  e01e11dca5e8b08fc8231b1cb6e2048c
- SHA1
  
  4983d07f004436caa3f10b38adacbba6a4ede01a
- SHA256
  
  58bfb9fa8889550d13f42473956dc2a7ec4f3abb18fd3faeaa38089d513c171f
- SHA512
  
  298bfb9fe55ddd80f1c6671622d7e9e865899a855b5bb8e0d85d8520160cedca6fd8bc72c9881925477bcab883bf6e6f4c69f997b774b74fe992e023a81269de
- SSDEEP
  
  1536:PcW4lAJGGnzjoih/NDh/NDuk+XkGAK/hztXcag+PlbBfkWIyvZrw281r5XsmCZEe:UWNGszjoih/NDh/NDuk+XkGAK/hztXcQ
Score

10^/10

evasion persistence ransomware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (56) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Windows security modification
  evasion trojan
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
behavioral5 behavioral6 behavioral7 behavioral8
- Target
  
  5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- Size
  
  91KB
- MD5
  
  be60e389a0108b2871dff12dfbb542ac
- SHA1
  
  14b4e0bfac64ec0f837f84ab1780ca7ced8d670d
- SHA256
  
  5d40615701c48a122e44f831e7c8643d07765629a83b15d090587f469c77693d
- SHA512
  
  6051bec441434a80c34ee2752a3da9c3a0307cd1b551aa27a0f7f6f75b9bf64b172745d80f03eea054a03ebd2c493df21fd48d8fa3b706d46a6f7fee0e7c0641
- SSDEEP
  
  1536:QguHLgeS6umiCp31W4qYXgsLlOqrgB9GpF7LXdarTkCAKL5dsluhtvM4CoLT6QPg:D6seqCp31Hgsp9a9GTrda8CAKLTsWkyI
Score

9^/10

ransomware
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Renames multiple (85) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Deletes itself
- Drops startup file
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
behavioral10 behavioral11 behavioral12 behavioral9
- Target
  
  ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- Size
  
  100KB
- MD5
  
  03b76a5130d0df8134a6bdea7fe97bcd
- SHA1
  
  60053d661ed03cd2a07f6750532e6ef11abcc4e5
- SHA256
  
  ae66e009e16f0fad3b70ad20801f48f2edb904fa5341a89e126a26fd3fc80f75
- SHA512
  
  d82eb0858819fc50b28910dfe8d537c8e7b0f34bc8953e48e7799b55ffe9320775df38c0ae38420808a0ddd84ea0d0c6b989b4348fcac52bbf2d1af7777091b8
- SSDEEP
  
  3072:P6seqCp31Hgsp9a9GTrda8CAKLTsWkyc:CqCp31Z9a9GTrk8CV/t
Score

1^/10
behavioral13 behavioral14 behavioral15 behavioral16
- Target
  
  c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- Size
  
  87KB
- MD5
  
  d6d956267a268c9dcf48445629d2803e
- SHA1
  
  cc0feae505dad9c140dd21d1b40b518d8e61b3a4
- SHA256
  
  c460fc0d4fdaf5c68623e18de106f1c3601d7bd6ba80ddad86c10fd6ea123850
- SHA512
  
  e0791f6eb3116d0590be3af3713c94f787f7ced8e904d4bb8fc0d1341f332053414cb1e9095ae2de041b9e6d6d55cf773bf45ebeb74f27bb95c11a3cc364abee
- SSDEEP
  
  1536:OXMLuZQG3KJ3QaIH9shR4fZcvr4C9u3MTIdD9mtthd9JovrgmqhtvM4CoLT6QPbc:gMLuZraJ3a0ehcvv9sM+9mtthd0gmWkr
Score

10^/10

evasion persistence ransomware trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies WinLogon for persistence
  persistence
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware
- Modifies boot configuration data using bcdedit
  ransomware evasion
- Renames multiple (59) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Blocklisted process makes network request
- Downloads MZ/PE file
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Windows security modification
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2
- Modifies WinLogon
  persistence
behavioral17 behavioral18 behavioral19 behavioral20

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Inhibit System Recovery

T1490

Tasks

Sharing

General

Malware Config

Targets

Contains code to disable Windows Defender

Modifies WinLogon for persistence

Modifies Windows Defender Real-time Protection settings

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (56) files with added filename extension

Blocklisted process makes network request

Downloads MZ/PE file

Checks computer location settings

Drops startup file

Windows security modification

Legitimate hosting services abused for malware hosting/C2

Modifies WinLogon

Deletes shadow copies

Renames multiple (85) files with added filename extension

Downloads MZ/PE file

Checks computer location settings

Deletes itself

Drops startup file

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Contains code to disable Windows Defender

Modifies WinLogon for persistence

Modifies Windows Defender Real-time Protection settings

Deletes shadow copies

Modifies boot configuration data using bcdedit

Renames multiple (59) files with added filename extension

Blocklisted process makes network request

Downloads MZ/PE file

Checks computer location settings

Drops startup file

Windows security modification

Enumerates connected drives

Legitimate hosting services abused for malware hosting/C2

Modifies WinLogon

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

We care about your privacy.